CVE-2026-110840GHSA-5qpp-pqww-h7fp
n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
n8n-io n8nFrameworks
CVSS
7.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.
Text from CVE List
Affected versions 2
- n8naffected: all versions before 2.41.4CVE List
- n8naffected: 2.42.0 before 2.42.1CVE List