SQL Injection Vulnerability in n8n Microsoft SQL Node

CVE-2026-110840

What is CVE-2026-110840?

n8n versions prior to 2.41.4 and those in the 2.42.x series before 2.42.1 are susceptible to an SQL injection vulnerability within the Microsoft SQL node. This flaw arises from the failure to properly parameterize user input in the Query field, leading to direct injection of untrusted data into SQL queries. When malicious actors exploit this vulnerability by binding untrusted inputs, such as webhook fields, they can execute arbitrary SQL statements against the database. This exploitation occurs with the privileges of the stored database credentials, potentially compromising sensitive data and operations.

References