CVE-2026-54310: n8n Workflow Automation SQLi Vulnerability

CVE-2026-54310 Overview

CVE-2026-54310 is a SQL injection vulnerability [CWE-89] in n8n, an open source workflow automation platform. The flaw exists in the TimescaleDB and legacy Postgres v1 nodes prior to versions 2.25.7 and 2.26.2. An authenticated user with permission to create or modify workflows can supply crafted parameters that inject and execute arbitrary SQL against the connected database. The injected statements run with the privileges of the configured database account, exposing data and operations beyond the workflow scope.

Critical Impact
Authenticated workflow editors can execute arbitrary SQL against connected TimescaleDB or Postgres instances, compromising data confidentiality, integrity, and availability at the database account's privilege level.

Affected Products

n8n workflow automation platform versions prior to 2.25.7
n8n workflow automation platform versions prior to 2.26.2
TimescaleDB node and legacy Postgres v1 node components

Discovery Timeline

2026-06-23 - CVE-2026-54310 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-54310

Vulnerability Analysis

The vulnerability resides in n8n's TimescaleDB and legacy Postgres v1 nodes. These nodes accept user-supplied parameters that are concatenated into SQL statements without proper parameterization or escaping. An authenticated user with workflow create or modify permissions can craft parameter values that break out of expected query context.

Once the malicious workflow executes, the injected SQL runs through the configured database connection. The attacker inherits the full privileges of the database account used by the node. Depending on the deployment, this can include read and write access to all tables, schema modification, and stored procedure execution.

The attack vector is network-based and requires low privileges, meaning any user with workflow editor rights inside the n8n instance qualifies. No user interaction is required once the workflow runs. The vulnerability falls under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is improper neutralization of user input in dynamic SQL construction within the TimescaleDB and Postgres v1 node implementations. Parameter values intended for data positions are interpolated directly into query strings rather than bound as prepared statement parameters.

Attack Vector

An authenticated user with workflow permissions creates or edits a workflow that invokes the affected nodes. The attacker supplies crafted SQL fragments inside node parameters such as table names, filter conditions, or column references. When the workflow executes, the database receives and runs the attacker-controlled SQL alongside the intended operation. See the GitHub Security Advisory GHSA-c37g-w77q-m4vp for technical details.

Detection Methods for CVE-2026-54310

Indicators of Compromise

Unexpected SQL statements in PostgreSQL or TimescaleDB query logs originating from the n8n application user
Workflow definitions containing SQL meta-characters such as ;, --, or /* inside Postgres or TimescaleDB node parameter fields
Database operations outside the expected workflow scope, including DROP, ALTER, or cross-schema SELECT queries from n8n sessions
Spikes in query volume or duration from the n8n service account

Detection Strategies

Enable PostgreSQL log_statement = 'all' on databases connected to n8n and review logs for anomalous syntax patterns
Audit n8n workflow JSON exports for suspicious parameter values in TimescaleDB and Postgres v1 nodes
Correlate n8n workflow execution events with database query logs to identify divergence between expected and actual SQL
Deploy database activity monitoring rules that alert on schema changes or privilege-sensitive operations from application accounts

Monitoring Recommendations

Forward n8n audit logs and PostgreSQL query logs to a centralized SIEM for correlation and retention
Alert on creation or modification of workflows that reference the legacy Postgres v1 node, which should be migrated
Track authentication events for n8n editor accounts and flag unusual workflow modification patterns

How to Mitigate CVE-2026-54310

Immediate Actions Required

Upgrade n8n to version 2.25.7 or 2.26.2 or later without delay
Audit all existing workflows that use the TimescaleDB or legacy Postgres v1 nodes for suspicious parameters
Rotate database credentials used by n8n connections after patching
Review and restrict the privileges of the database account configured for n8n to the minimum required

Patch Information

The vulnerability is fixed in n8n versions 2.25.7 and 2.26.2. Refer to the n8n GitHub Security Advisory for release details and upgrade instructions.

Workarounds

Restrict workflow create and modify permissions to a minimal set of trusted users until patching is complete
Migrate workflows from the legacy Postgres v1 node to the current Postgres node where possible
Configure the n8n database connection with a least-privilege account that cannot perform schema changes or access unrelated data
Place n8n behind network controls that limit which users can reach the editor interface

bash

# Verify installed n8n version and upgrade via npm
n8n --version
npm install -g n8n@2.26.2

# Or upgrade the official Docker image
docker pull n8nio/n8n:2.26.2
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.26.2