PT-2026-36903 · Oracle+1 · Oracle Database+1

Pawbednarz · Published 2026-04-22 · Updated 2026-05-13 · CVE-2026-42233

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1

Description A flaw in the Oracle Database node's select operation allows user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the Limit field, such as from a webhook, an attacker could inject arbitrary SQL to exfiltrate data from the connected Oracle database.

Recommendations Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1. As a temporary workaround, avoid passing external input into the Limit field of the Oracle Database node.

Fix

SQL injection

RCE

Weakness Enumeration

CWE-89

CWE-20

Related Identifiers

BDU:2026-06927

CVE-2026-42233

GHSA-R6JC-MPQW-M755

Affected Products

Oracle Database

N8N

References · 12

• https://github.com/n8n-io/n8n/security/advisories/GHSA-r6jc-mpqw-m755 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r6jc-mpqw-m755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42233 · Security Note
• https://bdu.fstec.ru/vul/2026-06927 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2051383970139419049 · Twitter Post
• https://vuldb.com/ru/vuln/360995 · Note
• https://twitter.com/VulmonFeeds/status/2051529086992781457 · Twitter Post
• https://twitter.com/byte_guard_blog/status/2052421697454723485 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054403978461388981 · Twitter Post
• https://t.me/CVEtracker/52660 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054403977467367767 · Twitter Post