CVE-2026-72775
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.
Risk Assessment
An attacker could gain full access to the PostgreSQL database, potentially leading to data theft, modification, or deletion. This is a serious risk to data integrity and confidentiality.
Recommendation
Update n8n to version 1.123.67, 2.31.5, or 2.32.1 (or later) to eliminate the SQL injection vulnerability in the PostgresTrigger node.
Original NVD description (English source)
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.