Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110840n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

High 7.0

In plain English

A high-severity SQL injection in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.3%top 78.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 2.41.42.42.0 – before 2.42.1

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:L

References

GitHub Security Advisory (GHSA-5qpp-pqww-h7fp) vendor-advisory
VulnCheck Advisory: n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field third-party-advisory