GHSA-JQWR-VX3P-R266: GHSA-JQWR-VX3P-R266: SQL Injection in n8n PostgresTrigger Node

#security #cve #cybersecurity #ghsa

GHSA-JQWR-VX3P-R266: SQL Injection in n8n PostgresTrigger Node

Vulnerability ID: GHSA-JQWR-VX3P-R266
CVSS Score: 5.8
Published: 2026-07-22

An authenticated SQL injection vulnerability (CWE-89) in n8n's PostgresTrigger node allows users with workflow creation or modification privileges to inject arbitrary SQL statements. Because n8n dynamically constructs database administration and event subscription queries by directly interpolating user-controlled parameters—such as PostgreSQL channel, function, and trigger names—without sanitization or identifier quoting, attackers can execute arbitrary queries within the context of the configured database credentials, potentially leading to unauthorized data exposure, system tampering, or remote code execution.

TL;DR

Authenticated n8n users can execute arbitrary SQL commands on connected PostgreSQL databases by exploiting unescaped identifier interpolation within the PostgresTrigger node.

Technical Details

CWE ID: CWE-89
Attack Vector: Network (Low Privileges Required)
CVSS Score: 5.8
Exploit Status: None (No verified public proof of concept)
Impact: Database Compromise / Potential Remote Code Execution
KEV Status: Not Listed

Affected Systems

n8n (npm package)
n8n-nodes-base module
n8n: < 1.123.67 (Fixed in: 1.123.67)
n8n: >= 2.0.0-rc.0, < 2.31.5 (Fixed in: 2.31.5)
n8n: >= 2.32.0, < 2.32.1 (Fixed in: 2.32.1)

Mitigation Strategies

Upgrade n8n deployment to a patched version immediately
Disable the vulnerable PostgresTrigger node globally using NODES_EXCLUDE
Apply least privilege principles to target PostgreSQL connection credentials

Remediation Steps:

Identify the current deployment branch (1.x, 2.x stable, or 2.x latest)
Pull and deploy the corresponding patched release (1.123.67, 2.31.5, or 2.32.1)
If patching is delayed, add export NODES_EXCLUDE="n8n-nodes-base.postgresTrigger" to n8n's environment configuration
Audit all PostgreSQL accounts stored in n8n to ensure they do not possess SUPERUSER status