n8n security advisory (AV26-1044)
Canada’s Cyber Centre urges updates for n8n SQL injection and workflow credential-check flaws.
Canadian Centre for Cyber Security advisory AV26-1044, dated October 15, 2026, says n8n versions before 1.123.83, 2.41.4, and 2.42.1 are vulnerable. The issues include SQL injection in the Microsoft SQL node through expression interpolation into the query field, and a shared-workflow credential check that misses nested and tool inline sub-workflows. Administrators are told to review the vendor links and apply updates. No CVE identifiers or exploitation reports are included.
- Affects n8n before 1.123.83, 2.41.4, and 2.42.1.
- SQL injection exists in the Microsoft SQL node query field.
- Shared-workflow credential checks miss nested inline sub-workflows.
- No CVE identifiers or exploitation status are given.
Full article80 words · extracted from cyber.gc.ca · click to collapse
Serial number: AV26-1044
Date: October 15, 2026
As of October 14, 2026, n8n is affected by vulnerabilities in the following product:
- n8n
- Prior to 1.123.83
- Prior to 2.41.4
- Prior to 2.42.1
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyber.gc.ca/en/alerts-advisories/n8n-security-advisory-av26-1044