CVE-2026-72775: n8n before 1.123.67 SQL Injection via PostgresTrigger Node
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8n (PostgresTrigger node)to a version that resolves this vulnerability.Fixed in 1.123.67 - Upgrade
Upgrade
n8n (PostgresTrigger node)to a version that resolves this vulnerability.Fixed in 2.31.5 - Upgrade
Upgrade
n8n (PostgresTrigger node)to a version that resolves this vulnerability.Fixed in 2.32.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72775?
CVE-2026-72775 has a risk score of 63, indicating a medium severity level.
How do I fix CVE-2026-72775?
To fix CVE-2026-72775, update n8n to version 1.123.67 or later, or 2.31.5 or later.
What is the impact of CVE-2026-72775?
CVE-2026-72775 allows authenticated users to perform SQL injection attacks via the PostgresTrigger node.
Who is affected by CVE-2026-72775?
CVE-2026-72775 affects users of n8n versions prior to 1.123.67, 2.31.5, and 2.32.1.
What kind of vulnerability is CVE-2026-72775?
CVE-2026-72775 is classified as an SQL Injection vulnerability.