CVE-2026-42233: n8n: SQL Injection in Oracle Database Node via Limit Field
Impact A flaw in the Oracle Database node's select operation allowed user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the Limit field (e.g., from a webhook), an attacker could inject arbitrary SQL and exfiltrate data from the connected Oracle database.
Exploitation requires a specific workflow configuration: - The Oracle Database node must be used with user-controlled input passed via expressions into the Limit field. - Authentication requirements depend on the workflow's configuration (e.g., an unauthenticated webhook endpoint would allow unauthenticated exploitation).
Patches The issue has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Disable the Oracle Database node by adding n8n-nodes-base.oracleDatabase to the NODESEXCLUDE environment variable. - Avoid passing unvalidated external user input into the Oracle Database node's Limit field via expressions.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allowed user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the Limit field (e.g., from a webhook), an attacker could inject arbitrary SQL and exfiltrate data from the connected Oracle database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42233?
CVE-2026-42233 is classified as a critical severity vulnerability due to the risk of SQL injection attacks.
How do I fix CVE-2026-42233?
To fix CVE-2026-42233, upgrade n8n to version 2.17.4 or later, or to version 1.123.32 or later.
What systems are affected by CVE-2026-42233?
CVE-2026-42233 affects n8n versions from 2.0.0 to 2.17.4 and version 2.18.0 specifically.
What type of attack does CVE-2026-42233 enable?
CVE-2026-42233 enables SQL injection attacks through user-controlled input in the Limit field.
How does CVE-2026-42233 impact my data?
CVE-2026-42233 can potentially allow attackers to manipulate SQL queries, leading to unauthorized access or manipulation of the database.