CVE-2026-54310

n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

State: Published
Severity: 6.5 Medium
Published: Jun 23, 2026
Updated: Jun 23, 2026
Reserved: Jun 12, 2026

Description

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2.

Scores

CVSS	Score	Vector	Source
4.0	6.5 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H	GitHub_M

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
n8nn8n-io	>= 2.26.0, < 2.26.2Affected < 2.25.7Affected

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.