CVE-2026-72750: n8n

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders.

Affected products

• n8n n8n: before 1.123.67 (fixed in 1.123.67); from 2.0.0, before 2.31.5 (fixed in 2.31.5); version 2.32.0 only

Published 2026-08-11. Last modified 2026-08-28.