CVE-2026-110840 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, workflow automation, and database security should assess exposure and prioritize remediation. This includes verifying and upgrading n8n instances to patched versions, assessing workflows that use the Microsoft SQL node and untrusted input, and implementing compensating controls. Security teams and operators managing n8n deployments should review the vulnerability's impact and take necessary actions to secure their环境

Why it matters

CVE-2026-110840 is a high-severity SQL injection vulnerability in n8n before 2.41.4 and 2.42.1. Defenders should prioritize verifying and upgrading n8n instances, assessing exposure, and implementing compensating controls.

• Unauthenticated external callers can execute arbitrary SQL against the connected database.
• The vulnerability can lead to data breaches and unauthorized access.
• Defenders need to verify and upgrade n8n instances to patched versions.
• Exposure requires verification from official sources.

Technical summary

The n8n workflow automation tool contains an SQL injection vulnerability in version 1 of the Microsoft SQL node. The vulnerability substitutes Query field expression values directly into SQL text without parameterisation, allowing unauthenticated external callers to execute arbitrary SQL against the connected database with the stored credential's privileges. This issue arises when a workflow binds untrusted input such as webhook fields to the Query field. Defenders should prioritize verifying and upgrading n8n instances to patched versions, assessing exposure, and implementing compensating controls.

Defensive priority

Defenders should prioritize verifying and upgrading n8n instances to patched versions, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify n8n instances for exposure and upgrade to patched versions (2.41.4 or 2.42.1) if vulnerable.
• Assess workflows that use the Microsoft SQL node and untrusted input.
• Implement compensating controls, such as input validation and monitoring.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in n8n before 2.41.4 and 2.42.1. The vulnerability exists in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.