CVE-2026-103253 in n8n
Summary
by MITRE • 10/01/2026
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The identified security flaw resides within n8n, a popular workflow automation platform, specifically affecting versions prior to 1.123.80 in the legacy branch, as well as versions from 2.0.0 up to but not including 2.39.6 and from 2.40.0 up to but not including 2.40.1. The vulnerability is localized to the Oracle Database node, which facilitates interactions with Oracle databases within automated workflows. More precisely, the defect occurs during the Delete Table Drop operation, a function designed to remove database tables or schemas based on user-provided parameters. This component fails to adequately sanitize input values before incorporating them into SQL queries sent to the backend database engine.
The technical nature of this vulnerability is classified as an injection flaw where unsanitized user-supplied data is directly concatenated into SQL commands without proper parameterization or escaping mechanisms. Specifically, attackers can exploit this by injecting single quote characters into the table name or schema fields provided during workflow configuration. This manipulation allows the attacker to break out of the intended string context within the SQL statement, thereby appending arbitrary Structured Query Language (SQL) statements. Because n8n executes these operations using the credentials configured for the database connection, the injected commands are executed with the same privileges as that service account.
The operational impact of this vulnerability is severe due to its potential for full system compromise at the database level. An authenticated attacker or a malicious actor who can influence workflow inputs can execute both Data Definition Language (DDL) and Data Manipulation (DML) commands against the connected Oracle Database. This capability enables actions such as dropping critical tables, altering schema structures, inserting malicious data, updating records to exfiltrate information, or even executing stored procedures that may interact with external systems if enabled by database configuration. The ability to execute arbitrary DDL commands poses a particularly high risk of service disruption and permanent data loss, while DML execution facilitates unauthorized data access and modification.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command commonly known as SQL Injection. It also maps to MITRE ATT&CK techniques related to Data Manipulation and Defense Evasion through database command injection. The lack of input validation on critical configuration fields within the workflow node represents a fundamental failure in secure coding practices, specifically regarding the principle of least privilege and safe query construction.
To mitigate this risk, organizations running affected versions of n8n must upgrade immediately to version 1.123.80 or later for legacy branches, or version 2.39.6 or later (excluding the vulnerable range up to 2.40.1) for current releases. The patched versions implement proper input sanitization and parameterized queries within the Oracle Database node operations, preventing the injection of malicious SQL fragments. Additionally, administrators should review workflow configurations that interact with databases to ensure no hardcoded credentials are used and consider implementing network-level controls such as firewalls or database activity monitoring systems to detect anomalous query patterns until all instances can be updated.