CVE-2026-103253: n8n Oracle Database Node SQL Injection

CVE-2026-103253 Overview

CVE-2026-103253 is a SQL injection vulnerability [CWE-89] in n8n, the open-source workflow automation platform. The flaw resides in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes into the table or schema input fields to break out of the intended query context. This allows appending arbitrary SQL statements that execute with the credentials configured on the connected Oracle database.

The issue affects n8n versions before 1.123.80, versions 2.0.0 through 2.39.5, and version 2.40.0. Fixed releases are 1.123.80, 2.39.6, and 2.40.1.

Critical Impact
Successful exploitation lets attackers execute arbitrary DDL and DML commands against the connected Oracle database with the stored credential's privileges, enabling data destruction, schema modification, and integrity compromise.

Affected Products

n8n versions before 1.123.80
n8n versions 2.0.0 through 2.39.5
n8n version 2.40.0

Discovery Timeline

2026-10-01 - CVE-2026-103253 published to the National Vulnerability Database (NVD)
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103253

Vulnerability Analysis

The vulnerability exists in the Oracle Database node shipped with n8n. When a workflow invokes the Delete Table Drop operation, user-supplied values for the table name and schema name are concatenated directly into the generated SQL statement. The node does not apply parameterized queries or identifier quoting to these fields.

An attacker who can author or modify a workflow, or who can influence the inputs feeding the Oracle node, can place a single quote inside the table or schema parameter. This terminates the intended identifier context and allows arbitrary SQL to be appended to the generated DROP TABLE statement. The injected statements execute inside the Oracle session established by the stored n8n credential.

Root Cause

The root cause is string concatenation of untrusted input into SQL. The Oracle node constructs the drop operation by interpolating the table and schema fields into the SQL text without escaping or validating identifier syntax. Oracle identifiers must be validated as safe tokens or quoted using database-specific identifier quoting, which the vulnerable code path omits.

Attack Vector

Exploitation requires network access to the n8n instance and the ability to supply input to a workflow node that performs the Oracle Delete Table Drop operation. The attacker provides a crafted table or schema value containing a single quote and additional SQL. The resulting statement runs with the privileges of the configured Oracle credential, allowing destructive DDL such as dropping additional tables, or DML such as modifying rows across the schema.

No verified public exploit code is available at the time of publication. See the GitHub Security Advisory GHSA-4wf3-rgqr-xcp3 and the VulnCheck Advisory for n8n SQL Injection for coordinated disclosure details.

Detection Methods for CVE-2026-103253

Indicators of Compromise

Oracle audit records showing DROP TABLE statements that contain unexpected trailing SQL, comment markers (--), or multiple statements originating from the n8n service account.
Workflow execution logs in n8n where the Oracle Database node table or schema parameter contains single quotes, semicolons, or SQL keywords.
Unexpected schema changes or missing tables in Oracle databases accessed by n8n credentials.

Detection Strategies

Review all workflows that use the Oracle Database node and inspect the Delete Table Drop operation inputs for untrusted or dynamic values.
Enable Oracle unified auditing on tables accessed by n8n credentials and alert on DDL operations outside of maintenance windows.
Correlate n8n execution logs with database audit trails to identify statements that deviate from the expected DROP TABLE "identifier" pattern.

Monitoring Recommendations

Monitor the n8n server version and alert when deployments fall behind 1.123.80, 2.39.6, or 2.40.1.
Alert on new workflow revisions that introduce or modify Oracle Database nodes.
Track outbound Oracle sessions from n8n hosts and flag privilege use beyond read-only operations if the account should be restricted.

How to Mitigate CVE-2026-103253

Immediate Actions Required

Upgrade n8n to 1.123.80, 2.39.6, or 2.40.1 depending on the deployed release train.
Audit stored Oracle credentials and reduce privileges to the minimum required for workflow operations.
Review recent n8n executions involving the Oracle Database node for signs of injected SQL.

Patch Information

n8n maintainers released fixes in versions 1.123.80, 2.39.6, and 2.40.1. Upgrade details and advisory text are published in the GitHub Security Advisory GHSA-4wf3-rgqr-xcp3.

Workarounds

Restrict workflow editing permissions in n8n to trusted operators until the upgrade is applied.
Avoid using the Oracle Database node's Delete Table Drop operation with dynamic or externally sourced table and schema values.
Configure the Oracle account used by n8n without DROP, ALTER, or broad DELETE privileges where business requirements allow.

bash

# Upgrade example for self-hosted n8n via npm
npm install -g n8n@1.123.80

# Or pin to the fixed 2.x release
npm install -g n8n@2.40.1

# Verify installed version
n8n --version