PT-2026-51781 · N8N · N8N

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-56351

Mitre

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-56351

Produtos afetados

N8N

Referências · 2

• https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx · Aviso do Fabricante
• https://vulncheck.com/advisories/n8n-sql-injection-in-mysql-postgresql-and-microsoft-sql-nodes · Nota