CVE-2026-42237

n8n: SQL Injection in Snowflake and MySQL Nodes

Published May 4, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node. Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping, enabling SQL injection against the connected database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Analysis

Technical impact

n8n includes Snowflake and legacy MySQL v1 nodes that build SQL statements by directly appending user-controlled table names, columns, and update keys without escaping. The flaw allows a malicious actor to inject arbitrary SQL, potentially reading or modifying data in the connected Snowflake or MySQL databases. This is a classic input validation issue, identified as CWE-89. The impact is the exposure of sensitive data and unintended database modifications, but it does not provide direct remote code execution.

Affected Systems

The vulnerability affects the n8n open source workflow automation platform. Versions prior to 1.123.32, 2.17.4, or 2.18.1 are impacted for the Snowflake and legacy MySQL v1 nodes. The product owner is n8n-io under the n8n product line.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an adversary that can configure or inject values into the Snowflake or MySQL node definitions, which may be achievable through compromised accounts or by injecting crafted payloads into workflow configurations.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n8n-io

n8n

affected

Version	Status	Constraints
`< 1.123.32`	affected	—
`>= 2.17.0, < 2.17.4`	affected	—
`>= 2.18.0, < 2.18.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:2.18.0::::enterprise:node.js::*

No data.

Vendor Product Versions

N8n

Version	Status	Scheme	Platform
`[0,1.123.32)`	affected	semver	—
`[2.17.0,2.17.4)`	affected	semver	—
`[2.18.0,2.18.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to n8n version 1.123.32, 2.17.4, or 2.18.1 or later to apply the vendor fix.
If an upgrade is not immediately possible, limit the database credentials used by the nodes to the least privileges required and verify that no untrusted input reaches the node configuration.
As a temporary measure, disable the Snowflake and legacy MySQL v1 nodes or replace them with secure alternatives until a patch can be applied.

Generated by OpenCVE AI on May 4, 2026 at 20:51 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-hp3c-vfpm-q4f7	n8n has SQL Injection in Snowflake and MySQL Nodes

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.254% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/n8n-io/n8n/security/advisories/GHSA-hp3c-vfpm-q4f7

History

May 6, 2026 5:30 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:n8n:n8n:::::enterprise:node.js:: cpe:2.3:a:n8n:n8n:2.18.0::::enterprise:node.js::*
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

May 5, 2026 10:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		N8n N8n n8n
Vendors & Products		N8n N8n n8n

May 4, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 4, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node. Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping, enabling SQL injection against the connected database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Title		n8n: SQL Injection in Snowflake and MySQL Nodes
Weaknesses		CWE-89
References		https://github.com/n8n-io/n8n/security/advisories/GHSA-hp3c-vfpm-q4f7
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'}`