The legacy MySQL v1 node in n8n has an SQL injection vulnerability (CVE-2026-59257) in its executeQuery operation. This occurs because the node substitutes evaluated expressions enclosed in {{ ... }} directly into raw SQL strings without parameterization. If these expressions incorporate attacker-controlled input via externally reachable triggers such as webhook nodes, an attacker can execute arbitrary SQL commands with the privileges of the configured MySQL credentials. This can lead to unauthorized disclosure, modification, or deletion of data in the connected database. The MySQL v2 node is not affected. The vulnerability is fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Until upgrading, administrators can disable the MySQL node, restrict access to vulnerable workflows, require authentication on webhook endpoints, or migrate workflows to the MySQL v2 node. These mitigations do not fully eliminate the risk and should be considered temporary.

Successful exploitation allows arbitrary SQL execution with the privileges of the configured MySQL credentials. This enables unauthorized disclosure, modification, or deletion of data in the downstream database. The vulnerability affects only workflows using the MySQL v1 node's executeQuery operation with expression interpolation and externally reachable triggers.

A fix is available in n8n versions 1.123.61, 2.27.4, and 2.28.1; users should upgrade to one of these versions or later. If upgrading immediately is not possible, temporary mitigations include disabling the MySQL node by adding 'n8n-nodes-base.mySql' to the NODES_EXCLUDE environment variable, auditing and restricting access to workflows using the MySQL v1 executeQuery operation, ensuring webhook endpoints require authentication, and migrating affected workflows to the MySQL v2 node which uses parameterized queries. These workarounds do not fully remediate the risk and should only be used short-term.