SQL Injection Vulnerability in n8n Affected by Improper Parameter Handling

CVE-2026-72775

What is CVE-2026-72775?

n8n prior to specific versions is susceptible to SQL injection in its PostgresTrigger node. The vulnerability arises when user-supplied identifiers, such as channel, function, and trigger names, are interpolated directly into SQL statements without sufficient escaping. This flaw can lead to unauthorized execution of arbitrary SQL commands in the context of the connected PostgreSQL database, allowing affected authenticated users to manipulate database content in ways that can compromise data integrity and security.

References