CVE-2026-110840: n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.41.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.42.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments are exposed when a workflow uses version 1 of the Microsoft SQL node and places untrusted input, such as webhook fields, into the node's Query field expression.
Does exploitation require an authenticated n8n user?
No. An unauthenticated external caller can exploit the issue when their input reaches the affected Query field through a workflow.
What access could an attacker gain in the connected database?
An attacker can execute arbitrary SQL against the connected database with the privileges of the credential stored for that Microsoft SQL node.
Which versions contain the fix?
The affected versions are n8n releases before 2.41.4 and 2.42.x releases before 2.42.1. Upgrading to 2.41.4 or 2.42.1 addresses the affected version 1 Microsoft SQL node behavior.