CVE-2026-59257 n8n CVE debrief

Who should care

Defenders responsible for n8n deployments, particularly those using the MySQL v1 node, should assess their exposure and prioritize verification and remediation. This includes reviewing workflow configurations and node versions, and implementing measures to prevent potential SQL injection attacks. Additionally, security teams and vulnerability management teams should be aware of the potential risks and take necessary steps to mitigate them.

Why it matters

CVE-2026-59257 is a SQL injection vulnerability in n8n that allows attackers to execute arbitrary SQL with configured MySQL credentials' privileges. Defenders should prioritize verifying and upgrading to a fixed version of n8n, reviewing workflows for potential exposure, and implementing parameterized queries.

• Potential execution of arbitrary SQL with configured MySQL credentials' privileges
• Possible data tampering or unauthorized access
• Required verification of workflow configurations and node versions
• Necessity for upgrading to fixed versions of n8n

Technical summary

The vulnerability is caused by the substitution of evaluated {{ ... }} expression values directly into the raw SQL string without parameterization in the legacy MySQL v1 node's executeQuery operation. This allows attackers to inject malicious SQL code when a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger. The affected product deployments include n8n versions before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1. Defenders should prioritize verifying and upgrading to a fixed version of n8n, as well as reviewing workflows for potential exposure.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of n8n, as well as reviewing workflows for potential exposure.

Recommended defensive actions

• Verify and upgrade to a fixed version of n8n
• Review workflows for potential exposure
• Implement parameterized queries
• Conduct a thorough review of workflow configurations and node versions
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. The vulnerability affects n8n versions before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.