GHSA-JQWR-VX3P-R266: SQL Injection in n8n PostgresTrigger Node

Vulnerability ID: GHSA-JQWR-VX3P-R266
CVSS Score: 5.8
Published: 2026-07-22

An authenticated SQL injection vulnerability (CWE-89) in n8n's PostgresTrigger node allows users with workflow creation or modification privileges to inject arbitrary SQL statements. Because n8n dynamically constructs database administration and event subscription queries by directly interpolating user-controlled parameters—such as PostgreSQL channel, function, and trigger names—without sanitization or identifier quoting, attackers can execute arbitrary queries within the context of the configured database credentials, potentially leading to unauthorized data exposure, system tampering, or remote code execution.

TL;DR

Authenticated n8n users can execute arbitrary SQL commands on connected PostgreSQL databases by exploiting unescaped identifier interpolation within the PostgresTrigger node.

Technical Details

• CWE ID: CWE-89
• Attack Vector: Network (Low Privileges Required)
• CVSS Score: 5.8
• Exploit Status: None (No verified public proof of concept)
• Impact: Database Compromise / Potential Remote Code Execution
• KEV Status: Not Listed

Affected Systems

• n8n (npm package)
• n8n-nodes-base module
• n8n: < 1.123.67 (Fixed in: 1.123.67)
• n8n: >= 2.0.0-rc.0, < 2.31.5 (Fixed in: 2.31.5)
• n8n: >= 2.32.0, < 2.32.1 (Fixed in: 2.32.1)

Mitigation Strategies

• Upgrade n8n deployment to a patched version immediately
• Disable the vulnerable PostgresTrigger node globally using NODES_EXCLUDE
• Apply least privilege principles to target PostgreSQL connection credentials

Remediation Steps:

1. Identify the current deployment branch (1.x, 2.x stable, or 2.x latest)
2. Pull and deploy the corresponding patched release (1.123.67, 2.31.5, or 2.32.1)
3. If patching is delayed, add export NODES_EXCLUDE="n8n-nodes-base.postgresTrigger" to n8n's environment configuration
4. Audit all PostgreSQL accounts stored in n8n to ensure they do not possess SUPERUSER status

References

• GitHub Security Advisory GHSA-jqwr-vx3p-r266
• GitHub Global Advisory Entry
• Discoverer Profile - sm1ee

Read the full report for GHSA-JQWR-VX3P-R266 on our website for more details including interactive diagrams and full exploit analysis.