CVE-2026-56351 Overview
CVE-2026-56351 is a SQL injection vulnerability [CWE-89] affecting n8n workflow automation platform versions prior to 2.4.0. The flaw resides in the MySQL, PostgreSQL, and Microsoft SQL nodes, where unescaped identifier values in node configuration parameters allow authenticated users to inject arbitrary SQL. Attackers with workflow creation permissions can supply crafted table or column names to execute unauthorized database commands. Successful exploitation compromises data integrity within the connected databases and can pivot into broader environment access through the workflow automation context.
Critical Impact
Authenticated users with workflow creation permissions can execute arbitrary SQL commands against connected MySQL, PostgreSQL, and Microsoft SQL databases, compromising data integrity and potentially exposing sensitive records.
Affected Products
- n8n workflow automation platform versions prior to 2.4.0
- MySQL node within affected n8n versions
- PostgreSQL and Microsoft SQL nodes within affected n8n versions
Discovery Timeline
- 2026-06-24 - CVE-2026-56351 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-56351
Vulnerability Analysis
The vulnerability stems from improper neutralization of special elements used in SQL commands within n8n database nodes. The MySQL, PostgreSQL, and Microsoft SQL node implementations accept table and column names as configuration parameters but fail to escape these identifier values before incorporating them into generated SQL statements.
An authenticated user with permission to create or modify workflows can supply crafted identifier strings that break out of the expected identifier context. The injected payload is then executed against the configured database connection with the privileges granted to that connection. The issue is classified as a SQL Injection weakness under [CWE-89].
Because n8n workflows commonly run with broad database credentials to support legitimate automation, exploitation can result in unauthorized reads, writes, or schema modifications across the target database.
Root Cause
The root cause is the absence of identifier escaping or allowlist validation for table and column name parameters in the affected database nodes. User-controlled identifiers are concatenated into SQL statements rather than being safely quoted using database-specific identifier escaping routines. See the GitHub Security Advisory and VulnCheck SQL Injection Advisory for vendor details.
Attack Vector
Exploitation requires authenticated access to an n8n instance with permission to create or edit workflows. The attacker configures a MySQL, PostgreSQL, or Microsoft SQL node and supplies a crafted value in a table or column identifier field. When the workflow executes, the injected SQL runs against the connected database. No user interaction beyond workflow execution is required, and the attack is delivered over the network through the n8n web interface or API.
No verified public proof-of-concept code is available. Refer to the linked advisories for technical details on the affected code paths.
Detection Methods for CVE-2026-56351
Indicators of Compromise
- Workflow definitions containing unusual characters such as backticks, double quotes, semicolons, or SQL keywords within table or column name fields of database nodes.
- Database audit logs showing unexpected DROP, ALTER, UNION, or INSERT statements originating from n8n service accounts.
- New or modified workflows created by accounts that do not typically author database automations.
Detection Strategies
- Review n8n workflow JSON exports for SQL metacharacters in identifier fields of n8n-nodes-base.mySql, n8n-nodes-base.postgres, and n8n-nodes-base.microsoftSql nodes.
- Enable database server query logging and alert on statements containing patterns inconsistent with normal n8n-generated SQL.
- Correlate n8n workflow execution logs with database query logs to identify anomalous SQL emitted by specific workflow runs.
Monitoring Recommendations
- Track creation and modification events for database-connected workflows, especially by non-administrator users.
- Monitor outbound query volume and error rates from database accounts used by n8n connections for sudden changes.
- Alert on schema modification events on databases reachable by n8n service credentials.
How to Mitigate CVE-2026-56351
Immediate Actions Required
- Upgrade n8n to version 2.4.0 or later, which contains the identifier escaping fix.
- Audit existing workflows for suspicious identifier values in MySQL, PostgreSQL, and Microsoft SQL nodes and remove any unauthorized modifications.
- Restrict workflow creation and editing permissions to trusted users until the upgrade is completed.
- Rotate database credentials used by n8n connections if exploitation is suspected.
Patch Information
The vendor addressed the issue in n8n version 2.4.0 by escaping identifier values supplied to MySQL, PostgreSQL, and Microsoft SQL nodes. Administrators should apply the upgrade following the guidance in the GitHub Security Advisory.
Workarounds
- Limit role-based access so only vetted users can create or modify workflows that include database nodes.
- Configure database accounts used by n8n with least-privilege permissions, restricting access to required schemas, tables, and statement types.
- Place n8n behind authentication and network controls that restrict workflow editing endpoints to trusted networks.
# Upgrade n8n via npm
npm install -g n8n@2.4.0
# Or pull the patched Docker image
docker pull n8nio/n8n:2.4.0
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.4.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
