CVE-2026-110840: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in n8n-io n8n
Description
An SQL injection vulnerability exists in n8n versions before 2.41.4 and in 2.42.x before 2.42.1 within the Microsoft SQL node version 1. This flaw allows unauthenticated external users to execute arbitrary SQL commands on the connected database by injecting malicious input into the Query field, which is not properly parameterized.
CVSS v4.0
Score 7.0high
Affected software
n8n-io
n8n
pkg:github/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110840 describes an SQL injection vulnerability in n8n's Microsoft SQL node version 1. The vulnerability arises because the Query field expression values are directly substituted into the SQL text without parameterization. When workflows bind untrusted inputs, such as webhook fields, to this Query field, attackers can execute arbitrary SQL commands with the privileges of the stored database credential. This affects n8n versions >=0 and <2.41.4, as well as versions >=2.42.0 and <2.42.1.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands on the database connected to n8n, potentially leading to data disclosure, modification, or destruction depending on the database privileges associated with the stored credential. This could compromise the confidentiality, integrity, and availability of the database.
Mitigation Recommendations
A fix is available in n8n versions 2.41.4 and 2.42.1 and later. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T22:12:22.054Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad00a612cdf04f656ba025a
Added to database: 10/14/2026, 23:04:01 UTC
Last enriched: 10/14/2026, 23:33:18 UTC
Last updated: 10/14/2026, 23:33:18 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.