CVE-2026-72775

Sažetak

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.

Reference

https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266
https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node

CVSS

Base:	0.0
Impact:	None
Exploitability:	None

Pristup

Vektor	Složenost	Autentikacija
None	None	None

Impact

Povjerljivost	Cjelovitost	Dostupnost
None	None	None

CVSS vektor

None

Zadnje važnije ažuriranje

11-08-2026 - 18:18

Objavljeno

11-08-2026 - 13:19