CVE-2026-72775 Overview
CVE-2026-72775 is a SQL injection vulnerability in the n8n workflow automation platform, specifically within the PostgresTrigger node. The node interpolates user-supplied identifier parameters, including channel, function, and trigger names, directly into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL that executes against the connected PostgreSQL database using the configured credential's privileges. This grants full read and write access to the target database. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated attackers can execute arbitrary SQL against the connected PostgreSQL database with full read and write privileges through the PostgresTrigger node.
Affected Products
- n8n versions prior to 1.123.67
- n8n versions prior to 2.31.5
- n8n versions prior to 2.32.1
Discovery Timeline
- 2026-08-11 - CVE CVE-2026-72775 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72775
Vulnerability Analysis
The vulnerability resides in the PostgresTrigger node of n8n, a widely used workflow automation platform. The node accepts identifier parameters from workflow authors to configure PostgreSQL LISTEN/NOTIFY channels, trigger functions, and trigger names. These identifiers are concatenated into SQL statements sent to the database rather than being safely quoted or validated. An authenticated user who can create or edit workflows can craft identifier values that break out of the intended SQL context and append arbitrary statements.
Because the injected SQL executes using the credentials configured on the PostgresTrigger node, the effective privilege level depends on that role. In many deployments the credential holds broad access to enable dynamic workflow behavior, meaning the attacker gains equivalent read and write access to the entire database.
Root Cause
The root cause is missing identifier escaping. PostgreSQL identifiers used in CREATE FUNCTION, CREATE TRIGGER, and LISTEN statements must be quoted with quote_ident() or an equivalent escaping routine. n8n's PostgresTrigger node interpolates the raw user-supplied strings directly into the SQL text, allowing statement termination and appended payloads.
Attack Vector
Exploitation requires an authenticated n8n user with permission to configure PostgresTrigger nodes. The attacker supplies a malicious value in the channel, function, or trigger name field, closing the identifier context and appending arbitrary SQL. When the workflow is activated, n8n sends the crafted SQL to the connected PostgreSQL server, which executes the injected statements. No user interaction on the victim side is required beyond running the workflow. See the GitHub Security Advisory for advisory details.
The vulnerability manifests entirely in the identifier interpolation path of the PostgresTrigger node. See the VulnCheck Security Advisory for technical details.
Detection Methods for CVE-2026-72775
Indicators of Compromise
- Unexpected CREATE FUNCTION, CREATE TRIGGER, or DROP statements in PostgreSQL server logs originating from n8n's database session.
- PostgresTrigger node configurations containing quote characters, semicolons, or SQL keywords inside channel, function, or trigger name fields.
- New database roles, altered privileges, or unfamiliar tables created by the credential associated with an n8n PostgresTrigger workflow.
Detection Strategies
- Enable PostgreSQL statement logging (log_statement = 'all') on databases connected to n8n and review activity generated by workflow credentials.
- Audit stored n8n workflow definitions for PostgresTrigger nodes whose identifier fields contain characters outside [A-Za-z0-9_].
- Correlate n8n audit logs of workflow edits and activations with anomalous PostgreSQL query patterns.
Monitoring Recommendations
- Alert on database sessions from n8n that issue DDL or DML outside the expected LISTEN/trigger setup pattern.
- Monitor n8n instances for new or modified PostgresTrigger nodes and require review before activation.
- Track privilege changes on PostgreSQL roles used by n8n credentials.
How to Mitigate CVE-2026-72775
Immediate Actions Required
- Upgrade n8n to version 1.123.67, 2.31.5, 2.32.1, or later immediately.
- Restrict n8n user permissions so only trusted operators can create or modify PostgresTrigger nodes.
- Rotate PostgreSQL credentials used by n8n and apply least-privilege roles limited to required schemas and operations.
Patch Information
The n8n maintainers released fixes in versions 1.123.67, 2.31.5, and 2.32.1. The patches escape identifier parameters passed to PostgreSQL from the PostgresTrigger node. Refer to the GitHub Security Advisory GHSA-jqwr-vx3p-r266 for release notes and upgrade guidance.
Workarounds
- Disable or remove PostgresTrigger nodes from workflows until the upgrade is applied.
- Configure the PostgreSQL credential used by n8n with a restricted role that cannot execute DDL or access sensitive tables.
- Place n8n behind strict authentication and role-based access controls to prevent untrusted users from editing workflows.
# Configuration example: upgrade n8n via npm
npm install -g n8n@1.123.67
# Or pull the patched Docker image
docker pull n8nio/n8n:1.123.67
# Restrict the PostgreSQL role used by n8n
psql -c "REVOKE ALL ON SCHEMA public FROM n8n_user;"
psql -c "GRANT USAGE ON SCHEMA app TO n8n_user;"
psql -c "GRANT SELECT, INSERT ON app.events TO n8n_user;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
