N8N N8N — CVE-2026-56351 (Critical)

Date Jun 24, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product N8N · N8N

CVE CVE-2026-56351

Critical vendor advisory CVE-2026-56351

Summary

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 8.2) in N8N N8N. Patch or mitigate promptly. EPSS percentile: 12%.

Operator check

Review CVE-2026-56351 in your asset inventory. Apply patches per vendor guidance and verify N8N is not exposed. CVSS score: 8.2. EPSS probability: 0.2%; percentile: 12%.

Sources

NVD — CVE-2026-56351 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed