CVE-2026-72750: n8n before 1.123.67 SQL Injection via executeQuery Operation
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8n (Snowflake node)to a version that resolves this vulnerability.Fixed in 1.123.67 - Upgrade
Upgrade
n8n (Snowflake node)to a version that resolves this vulnerability.Fixed in 2.31.5 - Upgrade
Upgrade
n8n (Snowflake node)to a version that resolves this vulnerability.Fixed in 2.32.1 - Configuration
In the Snowflake node's Execute Query operation, embed untrusted/external expression values using the optional 'Query Parameters' field (positional placeholders) so values are bound/parameterized rather than interpolated into the raw SQL string.
n8n workflow (SQL queries in Snowflake node Execute Query operation) Use Query Parameters with positional placeholders instead of embedding externally-controlled expression data directly in raw SQL = enabled