CVE-2026-42229 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, especially those exposed to external user input, should assess their exposure and prioritize patching vulnerable instances. This includes reviewing workflows for external user input passed via expressions to SeaTable nodes and implementing parameterization or escaping for SQL queries in SeaTable nodes.

Why it matters

CVE-2026-42229 is a SQL injection vulnerability in the n8n workflow automation platform that allows user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. Defenders responsible for n8n instances should assess their exposure, prioritize patching vulnerable instances, and implement parameterization or escaping for SQL queries in SeaTable nodes.

• Potential unauthorized data access via SQL injection
• Bypassing of row-level filtering logic in workflows
• Need for verification of affected versions and exposure
• Prioritization of patching and parameterization of SQL queries

Technical summary

The SeaTable node in n8n workflow automation platform is vulnerable to SQL injection due to user-controlled input being concatenated directly into SQL query strings without escaping or parameterization. This allows an attacker to manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic implemented in the workflow. The vulnerability affects the n8n workflow automation platform, specifically the SeaTable node, and has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Defensive priority

Defenders should prioritize patching vulnerable n8n instances, especially those exposed to external user input.

Recommended defensive actions

• Patch n8n instances to versions 1.123.32, 2.17.4, or 2.18.1
• Review workflows for external user input passed via expressions to SeaTable nodes
• Implement parameterization or escaping for SQL queries in SeaTable nodes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and patched versions. The vulnerability was patched in versions 1.123.32, 2.17.4, and 2.18.1. The SeaTable node in n8n workflow automation platform is vulnerable to SQL injection due to user-controlled input being concatenated directly into SQL query strings without escaping or parameterization. The CVE Program record and NVD detail page provide source-provided CVE metadata and source-specific vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.