CVE-2026-72775

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72775", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-10T15:09:12.955Z", "datePublished": "2026-08-11T12:17:13.395Z", "dateUpdated": "2026-10-29T21:16:47.195Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:16:47.195Z"}, "datePublic": "2026-07-22T00:00:00.000Z", "title": "n8n before 1.123.67 SQL Injection via PostgresTrigger Node", "descriptions": [{"lang": "en", "value": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "n8n-io", "product": "n8n", "defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.123.67"}, {"version": "1.123.67", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "n8n-io", "product": "n8n", "defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "versions": [{"version": "2.32.0", "status": "affected", "versionType": "semver", "lessThan": "2.32.1"}, {"version": "2.32.1", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "n8n-io", "product": "n8n", "defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "versions": [{"version": "2.0.0-rc.0", "status": "affected", "versionType": "semver", "lessThan": "2.31.5"}, {"version": "2.31.5", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "1.123.67"}, {"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "2.32.1", "versionStartIncluding": "2.32.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0-rc.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-jqwr-vx3p-r266)"}, {"name": "VulnCheck Advisory: n8n before 1.123.67 SQL Injection via PostgresTrigger Node", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node"}], "credits": [{"lang": "en", "value": "sm1ee", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T17:40:59.327653Z", "id": "CVE-2026-72775", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:50:19.590Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T17:40:59.327653Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:41:00.686Z"}}], "cna": {"title": "n8n before 1.123.67 SQL Injection via PostgresTrigger Node", "credits": [{"lang": "en", "type": "reporter", "value": "sm1ee"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "1.123.67", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.67", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.32.0", "lessThan": "2.32.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.32.1", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.0.0-rc.0", "lessThan": "2.31.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.31.5", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}], "datePublic": "2026-07-22T00:00:00.000Z", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266", "name": "GitHub Security Advisory (GHSA-jqwr-vx3p-r266)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node", "name": "VulnCheck Advisory: n8n before 1.123.67 SQL Injection via PostgresTrigger Node", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "1.123.67"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "2.32.1", "versionStartIncluding": "2.32.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0-rc.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:16:47.195Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72775", "state": "PUBLISHED", "dateUpdated": "2026-10-29T21:16:47.195Z", "dateReserved": "2026-08-10T15:09:12.955Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-11T12:17:13.395Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "product": "n8n", "vendor": "n8n-io", "versions": [{"lessThan": "1.123.67", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.67", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "product": "n8n", "vendor": "n8n-io", "versions": [{"lessThan": "2.32.1", "status": "affected", "version": "2.32.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.32.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/n8n", "product": "n8n", "vendor": "n8n-io", "versions": [{"lessThan": "2.31.5", "status": "affected", "version": "2.0.0-rc.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.31.5", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "4CBABC9C-8053-4556-99DF-B6A7BB96DFC0", "versionEndExcluding": "1.123.67", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "9834D769-4344-496B-8E27-78FC32EA8E76", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.31.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:*:node.js:*:*", "matchCriteriaId": "4AC4E002-974B-4748-A5CB-F8A40E4F3B24", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access."}, {"lang": "es", "value": "n8n antes de 1.123.67, 2.31.5 y 2.32.1 contiene una vulnerabilidad de inyecci\u00f3n SQL en el nodo PostgresTrigger, que interpola par\u00e1metros de identificador proporcionados por el usuario (nombres de canal, funci\u00f3n y disparador) en sentencias SQL sin el escape adecuado. Un usuario autenticado puede inyectar SQL arbitrario ejecutado contra la base de datos PostgreSQL conectada con los privilegios de la credencial configurada, permitiendo acceso completo de lectura y escritura."}], "id": "CVE-2026-72775", "lastModified": "2026-10-29T21:17:31.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72775", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T17:40:59.327653Z", "version": "2.0.3"}}]}, "published": "2026-08-11T13:19:08.040", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["node.js"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.123.67)"}}, {"platform": ["node.js"], "status": "unaffected", "versions": {"scheme": "semver", "value": "1.123.67"}}, {"platform": ["node.js"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.32.1)"}}, {"platform": ["node.js"], "status": "unaffected", "versions": {"scheme": "semver", "value": "2.32.1"}}, {"platform": ["node.js"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.31.5)"}}, {"platform": ["node.js"], "status": "unaffected", "versions": {"scheme": "semver", "value": "2.31.5"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "n8n", "vendor": "n8n"}], "created": "2026-08-12T00:15:12.315263+00:00", "updated": "2026-08-13T10:45:03.799524+00:00", "vendors": ["n8n", "n8n$PRODUCT$n8n"]}