CVE-2026-72750 is a SQL injection vulnerability in n8n's Snowflake node Execute Query operation. The flaw arises from embedding untrusted, externally-controlled expression data directly into raw SQL queries without parameterization, enabling injection attacks. The vulnerability affects n8n versions prior to 1.123.67, 2.31.5, and 2.32.1. The fix introduces an optional 'Query Parameters' field that allows binding values via positional placeholders, mitigating the injection risk.

An attacker who can supply untrusted expression data in workflows can exploit this vulnerability to perform SQL injection attacks against the Snowflake database. This could lead to unauthorized data access or manipulation. However, the CVSS score of 5.3 and medium severity indicate limited impact, requiring low privileges and partial user interaction.

A patch is available that fixes this vulnerability by adding a 'Query Parameters' field to bind values safely. Since this is a cloud service, the vendor manages remediation server-side. Users should verify that their n8n instance is updated to version 1.123.67, 2.31.5, 2.32.1 or later. Check the vendor advisory for confirmation of patch deployment and no additional action required if already mitigated.