CVE-2026-72775 is a SQL injection vulnerability affecting n8n's PostgresTrigger node in versions prior to 1.123.67, 2.31.5, and 2.32.1. The vulnerability arises because user-supplied identifier parameters (channel, function, and trigger names) are directly interpolated into SQL statements without proper escaping or sanitization. An authenticated user can exploit this to execute arbitrary SQL commands against the PostgreSQL database using the privileges of the configured credential, potentially compromising data confidentiality and integrity.

An authenticated attacker can execute arbitrary SQL commands on the PostgreSQL database connected to n8n, with the privileges of the configured credential. This can lead to unauthorized data access, modification, or deletion, resulting in full read and write access to the database. The vulnerability does not require user interaction beyond authentication and has a medium severity rating (CVSS 5.8). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and review database credential privileges to minimize potential impact.