Vulnerabilities ›

CVE-2026-42237

High

CWE-89 — Weakness Type

                    Published: May 4, 2026                      ·  Modified: May 11, 2026                      ·  Source: NVD                

CVSS v3

8.8

🔗 NVD Official

📄 Description (English)

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node. Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping, enabling SQL injection against the connected database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

🤖 AI Executive Summary

CVE-2026-42237 is a critical SQL injection vulnerability in n8n workflow automation platform affecting Snowflake and legacy MySQL v1 nodes. The vulnerability allows attackers to inject malicious SQL commands through unescaped table names, column names, and update keys, potentially leading to unauthorized database access, data exfiltration, or manipulation. Organizations using n8n for workflow automation connected to production databases face immediate risk of data compromise.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 8, 2026 16:34

🇸🇦 Saudi Arabia Impact Assessment

Saudi organizations in banking (SAMA-regulated institutions), government agencies (NCA oversight), healthcare providers, energy sector (ARAMCO and subsidiaries), and telecommunications (STC, Mobily) that utilize n8n for workflow automation face significant risk. Financial institutions connecting n8n to customer databases, government agencies automating data processing workflows, and healthcare organizations managing patient records through n8n are particularly vulnerable. The vulnerability could enable unauthorized access to sensitive financial data, personal information, and critical infrastructure data. Organizations in the Kingdom using n8n with Snowflake data warehouses or MySQL databases for business-critical workflows are at highest risk.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Healthcare and Medical Services Energy and Utilities Telecommunications Manufacturing Retail and E-commerce Insurance

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1589 - Gather Victim Identity Information T1592 - Gather Victim Host Information T1005 - Data from Local System T1020 - Automated Exfiltration T1565 - Data Manipulation T1040 - Network Sniffing

⚖️ Saudi Risk Score (AI)

8.5

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all n8n instances in your environment and document their version numbers

2. Audit all n8n workflows using Snowflake nodes or legacy MySQL v1 nodes

3. Review database access logs for suspicious SQL queries or unusual activity

4. Restrict network access to n8n instances to authorized users only

5. Implement database activity monitoring on connected Snowflake and MySQL instances



PATCHING GUIDANCE:

1. Upgrade n8n to version 1.123.32, 2.17.4, or 2.18.1 or later immediately

2. Test patches in non-production environments first

3. Schedule maintenance windows for production upgrades

4. Verify all workflows function correctly after patching



COMPENSATING CONTROLS (if immediate patching not possible):

1. Disable or remove all Snowflake and MySQL v1 nodes from active workflows

2. Implement database-level access controls restricting n8n service accounts to minimal required permissions

3. Use database views with restricted column access instead of direct table access

4. Implement SQL query whitelisting at the database level

5. Enable comprehensive database audit logging for all n8n-initiated queries



DETECTION RULES:

1. Monitor for SQL syntax errors in database logs from n8n connections

2. Alert on unusual SQL patterns: UNION, SELECT INTO, DROP, ALTER from n8n service accounts

3. Track failed authentication attempts to connected databases

4. Monitor for unexpected table/column access patterns

5. Implement IDS/IPS rules for SQL injection payloads in application traffic

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. حدد جميع مثيلات n8n في بيئتك وقم بتوثيق أرقام إصداراتها

2. قم بمراجعة جميع سير عمل n8n التي تستخدم عقد Snowflake أو عقد MySQL v1 القديمة

3. راجع سجلات الوصول إلى قاعدة البيانات للبحث عن استعلامات SQL مريبة أو نشاط غير عادي

4. قيد الوصول إلى شبكة مثيلات n8n للمستخدمين المصرح لهم فقط

5. طبق مراقبة نشاط قاعدة البيانات على مثيلات Snowflake و MySQL المتصلة

إرشادات التصحيح:

1. قم بترقية n8n إلى الإصدار 1.123.32 أو 2.17.4 أو 2.18.1 أو أحدث على الفور

2. اختبر التصحيحات في بيئات غير الإنتاج أولاً

3. جدول نوافذ الصيانة لترقيات الإنتاج

4. تحقق من أن جميع سير العمل تعمل بشكل صحيح بعد التصحيح

الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكناً):

1. عطل أو أزل جميع عقد Snowflake و MySQL v1 من سير العمل النشط

2. طبق ضوابط الوصول على مستوى قاعدة البيانات التي تقيد حسابات خدمة n8n بأقل الأذونات المطلوبة

3. استخدم طرق عرض قاعدة البيانات مع الوصول المقيد للأعمدة بدلاً من الوصول المباشر إلى الجدول

4. طبق قائمة بيضاء لاستعلامات SQL على مستوى قاعدة البيانات

5. فعّل تسجيل التدقيق الشامل لجميع الاستعلامات التي يبدأها n8n

قواعد الكشف:

1. راقب أخطاء بناء جملة SQL في سجلات قاعدة البيانات من اتصالات n8n

2. تنبيه على أنماط SQL غير العادية: UNION و SELECT INTO و DROP و ALTER من حسابات خدمة n8n

3. تتبع محاولات المصادقة الفاشلة لقواعد البيانات المتصلة

4. راقب أنماط الوصول غير المتوقعة للجدول/العمود

5. طبق قواعس IDS/IPS لحمولات حقن SQL في حركة المرور التطبيقية

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1.1 - Access Control and Authentication 5.2.1 - Data Protection and Encryption 5.3.1 - Vulnerability Management 5.4.1 - Incident Response and Management

🔵 SAMA CSF

ID.GV-1 - Organizational processes to manage cybersecurity risk PR.AC-1 - Identities and credentials are managed for authorized devices and users PR.DS-1 - Data-at-rest is protected DE.CM-1 - The network is monitored to detect potential cybersecurity events

🟡 ISO 27001:2022

A.5.1.1 - Policies for information security A.6.1.1 - Information security roles and responsibilities A.8.1.1 - User endpoint devices A.8.2.1 - User access management A.8.3.1 - Access control A.12.2.1 - Restrictions on information access and use A.12.6.1 - Management of technical vulnerabilities

🟣 PCI DSS v4.0.1

Requirement 1 - Install and maintain a firewall configuration Requirement 2 - Do not use vendor-supplied defaults Requirement 6 - Develop and maintain secure systems and applications Requirement 8 - Identify and authenticate access to system components

🔗 References & Sources 1

🔗

https://github.com/n8n-io/n8n/security/advisories/GHSA-hp3c-vfpm-q4f7

security-advisories@github.com

Vendor Advisory

📦 Affected Products / CPE 3 entries

n8n:n8n

n8n:n8n:2.18.0

📊 CVSS Score

8.8

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score8.8

CWECWE-89

EPSS0.03%

Exploit No

Patch ✗ No

Published 2026-05-04

Source Feed nvd

🇸🇦 Saudi Risk Score

8.5

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

CWE-89

🏢 Vendor Advisories

🔗 https://github.com/n8n-io/n8n/security/advisories/GH...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-42237

💬 Comments

Introduce Yourself

Sign In Required