CVE-2026-126381: n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key
n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.43.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.44.1 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Vector Store (OracleDB) node are exposed if they run a version before 2.43.5, a 2.44.x version before 2.44.1, or a 3.x version before 3.0.1. The vulnerable path involves vector search queries that use Metadata Filter keys.
What must an attacker be able to do to exploit it?
An attacker needs low-privilege access and must be able to supply a crafted Metadata Filter key through untrusted workflow input, such as a webhook. Exploitation has high attack complexity and does not require user interaction.
What data could be exposed?
A successful attack can read data accessible through the Oracle credential configured for the affected node. The provided information does not indicate integrity or availability impact.