Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-110840 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.2 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/n8n-io/n8n/security/advisories/GHSA-5qpp-pqww-h7fp	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-sql-injection-via-microsoft-sql-node-query-field	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	[email protected]

Affected Products

Product	Versions
n8n	< 2.41.4 (semver) < 2.42.1 (semver)
CPE cpe:2.3:a:n8n:n8n::::::node.js::* Remediation Upgrade: 2.41.4moderate effort Upgrade: 2.42.1moderate effort Mitigation:low effort Restrict n8n instance access to fully trusted users only. Mitigation:low effort Audit all workflows using the Microsoft SQL node and ensure that the Query field is not bound to expressions referencing untrusted external input such as webhook or HTTP request fields. Mitigation:low effort Deactivate webhook-triggered workflows that pass external input into a Microsoft SQL node's Query field until the instance is patched. Mitigation:low effort Upgrade the Microsoft SQL node to typeVersion 1.1 or later by removing and re-adding it, then move dynamic values into the Query Parameters option and reference them as positional parameters.

Product

Versions

n8n

< 2.41.4 (semver)

< 2.42.1 (semver)

CPE

cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*

Remediation

Upgrade: 2.41.4moderate effort
Upgrade: 2.42.1moderate effort
Mitigation:low effort
Restrict n8n instance access to fully trusted users only.
Mitigation:low effort
Audit all workflows using the Microsoft SQL node and ensure that the Query field is not bound to expressions referencing untrusted external input such as webhook or HTTP request fields.
Mitigation:low effort
Deactivate webhook-triggered workflows that pass external input into a Microsoft SQL node's Query field until the instance is patched.
Mitigation:low effort
Upgrade the Microsoft SQL node to typeVersion 1.1 or later by removing and re-adding it, then move dynamic values into the Query Parameters option and reference them as positional parameters.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 15, 2026	CVE Modified	CISA-ADP
Oct 14, 2026	New CVE Received	[email protected]