PT-2026-56448 · N8N · N8N

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59257

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0

Description A SQL injection issue exists in the legacy MySQL v1 node during the executeQuery operation. The system substitutes evaluated {{ ... }} expression values directly into the raw SQL string without using parameterization. If a workflow utilizes this operation with expression-sourced values and is linked to an externally-reachable trigger, such as a Webhook node, an attacker can provide malicious input to execute arbitrary SQL commands using the privileges of the configured MySQL credentials.

Recommendations Update to version 1.123.61 or later. Update to version 2.27.4 or later. Update to version 2.28.1 or later. As a temporary mitigation, avoid using the executeQuery operation in the legacy MySQL v1 node or restrict the use of expression-sourced values in that operation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-59257

Affected Products

N8N

References · 4

• https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59257 · Security Note
• https://vulncheck.com/advisories/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolation · Note
• https://twitter.com/MalwareObserver/status/2074866587568316528 · Twitter Post