CVE-2026-42237 Details
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node. Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping, enabling SQL injection against the connected database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
A SQL injection vulnerability has been identified in the open-source workflow automation platform n8n, affecting versions prior to 1.123.32, 2.17.4, and 2.18.1. The issue arises in the Snowflake node and the legacy MySQL v1 node, where SQL queries are constructed by directly inserting user-controlled table names, column names, and update keys into query strings without proper escaping. This oversight allows for SQL injection attacks against the connected database. Exploitation requires specific workflow configurations that involve passing unvalidated external user input into identifier fields via expressions.
Users are advised to upgrade to n8n versions 1.123.32, 2.17.4, or 2.18.1. If an immediate upgrade is not possible, consider limiting workflow permissions to trusted users, migrating from the legacy MySQL v1 node to the MySQL v2 node, disabling the Snowflake node, or avoiding the use of unvalidated external input in the affected nodes.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-hp3c-vfpm-q4f7 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.32 >= 2.17.0, < 2.17.4 2.18.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | [email protected] |