Changeflow GovPing Data Privacy & Cybersecurity n8n SQL-injection vulnerability, CVSS 8.8
Priority review Notice Amended Final

n8n SQL-injection vulnerability, CVSS 8.8

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published March 26th, 2026
Detected March 28th, 2026
Email

Summary

CERT-Bund has issued a security advisory for n8n, detailing a critical SQL-injection vulnerability (CVSS 8.8) affecting versions prior to 1.123.26, 2.14.1, and 2.13.3. The vulnerability allows remote authenticated attackers to execute SQL injection attacks. Mitigation is available.

View original document View source feed page

What changed

CERT-Bund has released a security advisory (WID-SEC-2026-0885) concerning a critical SQL-injection vulnerability in the n8n workflow automation tool. The vulnerability, rated with a CVSS Base Score of 8.8, allows remote authenticated attackers to exploit the system. Affected versions include n8n <1.123.26, n8n <2.14.1, and n8n <2.13.3, impacting Linux, UNIX, and Windows operating systems.

Organizations using n8n must immediately review their installed versions and apply available mitigations or update to a patched version to prevent potential data breaches and unauthorized access. Failure to address this vulnerability could lead to significant data compromise and operational disruption. The advisory indicates that mitigation measures are available, and users should consult the provided links for specific guidance and version history.

What to do next

  1. Review n8n version for applicability to advisory WID-SEC-2026-0885
  2. Apply available mitigations or update to a patched version of n8n

Source document (simplified)

[WID-SEC-2026-0885] n8n: Schwachstelle ermöglicht SQL-Injection CVSS Base Score 8.8 (hoch) CVSS Temporal Score 7.7 (hoch) Remoteangriff ja Datum 26.03.2026 Stand 27.03.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Linux
  • Sonstiges
  • UNIX
  • Windows

Produktbeschreibung

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Produkte

26.03.2026
- n8n n8n <1.123.26

  • n8n n8n <2.14.1

  • n8n n8n <2.13.3

Angriff

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in n8n ausnutzen, um einen SQL-Injection Angriff durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Related changes

Favicon for wid.cert-bund.de Dovecot Vulnerabilities Allow SQL Injection, Authentication Bypass, Info Exposure
Priority review Mar 28, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de IBM App Connect Enterprise Critical Vulnerabilities
Urgent Mar 28, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de LangChain vulnerability allows information disclosure
Priority review Mar 28, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for www.nist.gov Draft NIST Cyber AI Profile for Cybersecurity Guidelines
Priority review Mar 28, 2026 • NIST News • Data Privacy & Cybersecurity
Favicon for usdaoig.oversight.gov USDA IT Security Directives Lack Relevance and Effectiveness
Priority review Mar 28, 2026 • USDA OIG Reports • Agriculture & Food Safety
Favicon for usdaoig.oversight.gov USDA Web Application Security Vulnerabilities Inspection Report
Priority review Mar 28, 2026 • USDA OIG Reports • Agriculture & Food Safety

Source

Favicon for wid.cert-bund.de
CERT-Bund Security Advisories wid.cert-bund.de/content/public/securityAdvisory/rss
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-Bund
Published
March 26th, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
WID-SEC-2026-0885

Who this affects

Applies to
Employers
Industry sector
5112 Software & Technology
Activity scope
Workflow Automation Data Security
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Software Vulnerabilities Data Security

Browse Categories

Agriculture & Food Safety 63 AI Regulation 3 Banking & Finance 265 Consumer Protection 44 Courts & Legal 358 Data Privacy & Cybersecurity 69 Defense & National Security 52 Education 20 Energy 106 Environment 85 Government & Legislation 285 Healthcare 136 Housing 16 Immigration 9 Insurance 56 Labor & Employment 114 Legal & Courts 1 Pharma & Drug Safety 103 Securities & Markets 87 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Sanctions 124 Transportation 57

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.