CVE-2026-42229 is an SQL injection vulnerability in n8n's SeaTable node affecting the row:search and row:get operations. In affected versions, user input passed via expressions into these node parameters is concatenated directly into SQL query strings without neutralizing special elements. This improper input handling allows attackers to alter the constructed SQL queries, potentially retrieving unauthorized data by bypassing workflow-implemented row-level filters. The vulnerability is fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1.

Exploitation of this vulnerability could allow an attacker with the ability to influence workflow inputs to retrieve unintended rows from the connected SeaTable database. This bypasses row-level filtering controls within the workflow, potentially exposing sensitive or restricted data. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector with low attack complexity but requiring partial user interaction and low privileges.

This vulnerability has been patched in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated in the vendor advisory. Patch status is confirmed by the vendor advisory.