CVE-2026-44792: N8n Workflow Automation SQL Injection Flaw

CVE-2026-44792 Overview

CVE-2026-44792 is a SQL injection vulnerability [CWE-89] in n8n, an open source workflow automation platform. An attacker with write access to a git repository connected to an n8n Source Control configuration can commit a malicious Data Table JSON file containing a crafted column name. When an administrator triggers a Source Control Pull, n8n imports the file and executes attacker-controlled SQL against the internal PostgreSQL instance. The vulnerability affects n8n versions prior to 1.123.43, 2.22.1, and 2.20.7.

Critical Impact
Successful exploitation allows arbitrary SQL execution on the backing PostgreSQL database, enabling read, modification, or deletion of workflow data, credentials, and execution history.

Affected Products

n8n versions prior to 1.123.43
n8n versions prior to 2.22.1
n8n versions prior to 2.20.7 (using PostgreSQL backend with Source Control enabled)

Discovery Timeline

2026-06-23 - CVE-2026-44792 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-44792

Vulnerability Analysis

The vulnerability stems from improper handling of user-supplied identifiers in Data Table import logic. n8n's Source Control feature synchronizes workflow definitions and Data Table definitions from a git repository into the local instance. During a Source Control Pull, n8n parses Data Table JSON files and uses field values, including column names, to construct SQL statements against the internal PostgreSQL database.

Because column names are interpolated into SQL without sufficient sanitization or identifier quoting, an attacker who controls the JSON file can break out of the identifier context and inject arbitrary SQL. The injected statements execute with the privileges of the n8n database user, which typically holds full read/write access to the n8n schema.

Root Cause

The root cause is unsafe construction of dynamic SQL using attacker-controlled identifiers from imported Data Table definitions. SQL identifiers cannot be safely passed as bound parameters, so they require strict allow-list validation or proper identifier escaping. n8n's import routine omitted that validation, allowing a crafted column name to terminate the identifier and append arbitrary SQL.

Attack Vector

Exploitation requires three preconditions: the n8n instance uses PostgreSQL as its database backend, the Source Control feature is enabled and connected to a repository the attacker can write to, and an administrator triggers a Source Control Pull. The attacker commits a malicious Data Table JSON file with a crafted column name to the linked repository. When the administrator pulls, n8n imports the file and executes the injected SQL on PostgreSQL. The vulnerability is described in detail in the n8n GitHub Security Advisory GHSA-mhrx-qhrj-673w.

Detection Methods for CVE-2026-44792

Indicators of Compromise

Unexpected commits to the git repository linked to n8n Source Control, particularly modifications to Data Table JSON files
Data Table definitions containing column names with SQL metacharacters such as quotes, semicolons, or parenthesized subqueries
PostgreSQL audit log entries showing DDL or DML statements originating from the n8n service account around the time of a Source Control Pull
Unexplained schema changes, new database roles, or modified credential records in the n8n database

Detection Strategies

Review git history of the Source Control repository for commits from unexpected contributors that touch Data Table definitions
Enable PostgreSQL statement logging (log_statement = 'ddl' or 'mod') and alert on anomalous queries from the n8n connection
Validate Data Table JSON files against a strict schema that restricts column names to alphanumeric characters and underscores before import

Monitoring Recommendations

Monitor n8n application logs for Source Control Pull events and correlate them with subsequent PostgreSQL activity
Alert on creation of new database users, roles, or extensions in the n8n PostgreSQL instance
Track administrator actions that initiate Source Control synchronization and require change approval

How to Mitigate CVE-2026-44792

Immediate Actions Required

Upgrade n8n to version 1.123.43, 2.22.1, or 2.20.7 or later depending on your release track
Audit the linked Source Control git repository for unauthorized contributors and revoke unnecessary write access
Review recent Source Control Pull activity and inspect the n8n PostgreSQL database for unexpected modifications
Rotate credentials and secrets stored within n8n if compromise is suspected

Patch Information

The vulnerability is fixed in n8n versions 1.123.43, 2.22.1, and 2.20.7. Patch details are published in the n8n GitHub Security Advisory GHSA-mhrx-qhrj-673w.

Workarounds

Disable the Source Control feature until the instance is patched
Restrict write access on the linked git repository to a minimal set of trusted maintainers and enforce signed commits
Require code review on all changes to Data Table JSON files before they reach the branch n8n pulls from
Run the n8n PostgreSQL user with the least privileges required for application operation to limit blast radius

bash

# Configuration example: verify installed n8n version and upgrade
npm list -g n8n
npm install -g n8n@1.123.43
# or for the 2.22.x track
npm install -g n8n@2.22.1
# or for the 2.20.x track
npm install -g n8n@2.20.7