CVE-2026-72750

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72750", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-10T13:53:42.483Z", "datePublished": "2026-08-11T12:17:03.494Z", "dateUpdated": "2026-10-29T21:16:35.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:16:35.526Z"}, "datePublic": "2026-07-22T00:00:00.000Z", "title": "n8n before 1.123.67 SQL Injection via executeQuery Operation", "descriptions": [{"lang": "en", "value": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "n8n-io", "product": "n8n", "defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.123.67"}, {"version": "1.123.67", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "n8n-io", "product": "n8n", "defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "versions": [{"version": "2.32.0", "status": "affected", "versionType": "semver", "lessThan": "2.32.1"}, {"version": "2.32.1", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "n8n-io", "product": "n8n", "defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "versions": [{"version": "2.0.0-rc.0", "status": "affected", "versionType": "semver", "lessThan": "2.31.5"}, {"version": "2.31.5", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "1.123.67"}, {"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "2.32.1", "versionStartIncluding": "2.32.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0-rc.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-652q-gvq3-74qv", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-652q-gvq3-74qv)"}, {"name": "VulnCheck Advisory: n8n before 1.123.67 SQL Injection via executeQuery Operation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-executequery-operation"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T19:26:25.928226Z", "id": "CVE-2026-72750", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:26:34.170Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72750", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T19:26:25.928226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:26:30.522Z"}}], "cna": {"title": "n8n before 1.123.67 SQL Injection via executeQuery Operation", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "1.123.67", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.67", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.32.0", "lessThan": "2.32.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.32.1", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.0.0-rc.0", "lessThan": "2.31.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.31.5", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}], "datePublic": "2026-07-22T00:00:00.000Z", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-652q-gvq3-74qv", "name": "GitHub Security Advisory (GHSA-652q-gvq3-74qv)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-executequery-operation", "name": "VulnCheck Advisory: n8n before 1.123.67 SQL Injection via executeQuery Operation", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "1.123.67"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "2.32.1", "versionStartIncluding": "2.32.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0-rc.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:16:35.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72750", "state": "PUBLISHED", "dateUpdated": "2026-10-29T21:16:35.526Z", "dateReserved": "2026-08-10T13:53:42.483Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-11T12:17:03.494Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "product": "n8n", "vendor": "n8n-io", "versions": [{"lessThan": "1.123.67", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.67", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "product": "n8n", "vendor": "n8n-io", "versions": [{"lessThan": "2.32.1", "status": "affected", "version": "2.32.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.32.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "product": "n8n", "vendor": "n8n-io", "versions": [{"lessThan": "2.31.5", "status": "affected", "version": "2.0.0-rc.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.31.5", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "matchCriteriaId": "D963758D-5493-4A20-881B-DE05BAFAD896", "versionEndExcluding": "1.123.67", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "matchCriteriaId": "32A28E0A-5FBC-4C97-B443-540E01F80C8A", "versionEndExcluding": "1.123.67", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "matchCriteriaId": "AD768539-E781-401F-BE44-02E438BA9F6A", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "matchCriteriaId": "969CE8A9-6759-4E7C-AC79-81FF38772F70", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:community:node.js:*:*", "matchCriteriaId": "A6AC605A-BDCF-4BFC-8B13-760CA2BD4C6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:enterprise:node.js:*:*", "matchCriteriaId": "20BD46BF-7D8F-4035-A8B9-E8338BF96909", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders."}, {"lang": "es", "value": "n8n antes de 1.123.67, 2.31.5 y 2.32.1 contiene una vulnerabilidad de inyecci\u00f3n SQL en la operaci\u00f3n Execute Query del nodo Snowflake, que interpola valores de expresi\u00f3n directamente en la cadena SQL. Cuando un autor de flujo de trabajo incrusta datos de expresi\u00f3n no confiables y controlados externamente directamente en una consulta SQL sin procesar, esos datos no est\u00e1n parametrizados, lo que permite la inyecci\u00f3n SQL. La soluci\u00f3n a\u00f1ade un campo opcional Query Parameters para vincular valores a trav\u00e9s de marcadores de posici\u00f3n posicionales."}], "id": "CVE-2026-72750", "lastModified": "2026-10-29T20:17:33.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72750", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T19:26:25.928226Z", "version": "2.0.3"}}]}, "published": "2026-08-11T13:19:06.097", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-652q-gvq3-74qv"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-executequery-operation"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["node.js"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.123.67)"}}, {"platform": ["node.js"], "status": "unaffected", "versions": {"scheme": "semver", "value": "1.123.67"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 82.0, "source": "matching"}]}, "original": {"product": "n8n", "source": "cna", "vendor": "n8n-io"}, "product": "n8n", "vendor": "n8n"}, {"configurations": [{"platform": ["node.js"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.32.1)"}}, {"platform": ["node.js"], "status": "unaffected", "versions": {"scheme": "semver", "value": "2.32.1"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 82.0, "source": "matching"}]}, "original": {"product": "n8n", "source": "cna", "vendor": "n8n-io"}, "product": "n8n", "vendor": "n8n"}, {"configurations": [{"platform": ["node.js"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.31.5)"}}, {"platform": ["node.js"], "status": "unaffected", "versions": {"scheme": "semver", "value": "2.31.5"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 82.0, "source": "matching"}]}, "original": {"product": "n8n", "source": "cna", "vendor": "n8n-io"}, "product": "n8n", "vendor": "n8n"}], "created": "2026-08-12T00:00:03.979867+00:00", "updated": "2026-08-13T10:45:03.806405+00:00", "vendors": ["n8n", "n8n$PRODUCT$n8n"]}