CVE-2026-42229 Details
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic implemented in the workflow. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
A SQL injection vulnerability has been identified in the SeaTable node of n8n, an open-source workflow automation platform. This issue affects versions prior to 1.123.32, 2.17.4, and 2.18.1. The vulnerability arises in the 'row:search' and 'row:get' operations, where user-controlled input can be directly concatenated into SQL query strings without proper escaping or parameterization. As a result, an attacker could manipulate the SQL query to retrieve unintended rows from the connected SeaTable base, bypassing any row-level filtering applied in the workflow. Exploitation requires that external user input be passed through expressions into the SeaTable node's search or row retrieval parameters.
Users can upgrade to n8n versions 1.123.32, 2.17.4, or 2.18.1 to address this vulnerability. If an immediate upgrade is not possible, consider limiting workflow permissions to trusted users, disabling the SeaTable node by excluding it in the 'NODES_EXCLUDE' environment variable, or avoiding the use of unvalidated external input in SeaTable node parameters.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-mp4j-h6gh-f6mp | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.32 >= 2.17.0, < 2.17.4 2.18.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | [email protected] |