CVE-2026-44792 is an SQL injection vulnerability in n8n prior to versions 1.123.43, 2.20.7, and 2.22.1. An attacker with write access to the git repository used by n8n's Source Control feature can commit a malicious JSON file containing a crafted column name. When an administrator triggers a Source Control Pull, n8n imports this file and executes SQL commands on its internal PostgreSQL database without proper neutralization of special elements, leading to SQL injection. This requires the n8n instance to use PostgreSQL, have Source Control enabled and connected to a repository writable by the attacker, and an administrator to perform the pull. The vulnerability is addressed in the specified fixed versions.

Successful exploitation can lead to SQL injection on the internal PostgreSQL database used by n8n, potentially allowing an attacker to execute arbitrary SQL commands. This could compromise data integrity, confidentiality, and availability within the affected n8n instance. However, exploitation requires multiple conditions: attacker write access to the connected git repository, use of PostgreSQL as the backend, enabled Source Control feature, and an administrator performing a Source Control Pull.

A fix is available in n8n versions 1.123.43, 2.20.7, and 2.22.1. Users should upgrade to these or later versions to remediate this vulnerability. Until upgraded, restrict write access to the git repository connected to n8n Source Control and limit administrative actions that trigger Source Control Pulls. Patch status is confirmed by the vendor through fixed versions; no additional vendor advisory was provided.