CVE-2026-59257 Details
Description
n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.
A SQL injection vulnerability has been identified in n8n versions prior to 1.123.61, 2.x prior to 2.27.4, and 2.28.x prior to 2.28.1. The issue arises in the legacy MySQL v1 node's executeQuery operation, where evaluated expression values are directly inserted into the SQL string without proper parameterization. This flaw allows attacker-controlled input to manipulate the SQL query, executing arbitrary SQL commands with the privileges of the MySQL credentials used in the workflow. The vulnerability is exploitable when the workflow is connected to an externally reachable trigger, such as a Webhook node. Notably, the MySQL v2 node is not affected, as it employs parameterized queries.
Users can upgrade to n8n versions 1.123.61, 2.27.4, or 2.28.1 to address this vulnerability. If an immediate upgrade is not possible, the MySQL v1 node can be disabled or access to affected workflows can be restricted. Alternatively, workflows can be migrated to use the MySQL v2 node, which is not vulnerable.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9 | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolation | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.61 >= 2.0.0, < 2.27.4 2.28.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | New CVE Received | [email protected] |