CVE-2026-72775 in n8n
Summary
by MITRE • 08/11/2026
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within n8n's PostgresTrigger node implementation where user-supplied identifier parameters including channel function and trigger names are directly interpolated into SQL statements without proper sanitization or parameterization. This represents a classic sql injection flaw that allows authenticated attackers to manipulate database queries through malicious input values. The affected versions encompass multiple release branches indicating this issue has persisted across significant codebases and maintenance cycles.
The technical exploitation occurs when an attacker constructs specially crafted identifiers that contain sql payload fragments which get executed as part of the database query. This vulnerability specifically targets the interpolation mechanism used in postgresql query construction where parameter binding is not properly implemented for these identifier values. The attack vector requires authentication since the node operates within the context of configured database credentials, meaning any authenticated user with access to this particular node can leverage the flaw.
The operational impact is severe as the vulnerability allows full read and write access to the connected postgresql database with the privileges granted to the configured credential. This means attackers can extract sensitive data, modify or delete information, create new database entries, and potentially escalate their access further within the database environment. The privilege escalation aspect is particularly concerning since database credentials often have elevated permissions that could compromise entire database systems.
According to CWE classification this vulnerability maps to CWE-89 SQL injection which is one of the most critical web application security flaws. The ATT&CK framework categorizes this under technique T1071.004 Application Layer Protocol: DNS and T1566 Credential Access through various attack paths including credential access and privilege escalation techniques. The vulnerability also aligns with T1213 Data from Information Repositories as attackers can extract data directly from the database without requiring additional exploitation steps.
Mitigation strategies should focus on implementing proper parameterization of all database identifiers in the PostgresTrigger node, using prepared statements or proper escaping mechanisms for dynamic identifier values. The fix must ensure that user-supplied channel function and trigger names are properly sanitized before being incorporated into sql queries. Organizations should also implement least privilege principles for database credentials, ensuring that n8n instances only have necessary permissions for their operations. Additionally implementing input validation and monitoring for unusual parameter patterns can help detect potential exploitation attempts. The vulnerability highlights the importance of proper database query construction practices and demonstrates how seemingly innocuous identifier interpolation can create critical security risks in automated workflow systems.