CVE-2026-42233
published 2026-05-04CVE-2026-42233: n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.33%
24.4th percentile
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allowed user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the Limit field (e.g., from a webhook), an attacker could inject arbitrary SQL and exfiltrate data from the connected Oracle database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| n8n-io | n8n | < 1.123.32 | 1.123.32 |
| n8n-io | n8n | — | — |
| n8n-io | n8n | — | — |
| n8n | n8n | < 1.123.32 | 1.123.32 |
| n8n | n8n | — | — |
| n8n | n8n | >= 0 < 1.123.32 | 1.123.32 |
| n8n | n8n | >= 2.0.0 < 2.17.4 | 2.17.4 |
| n8n | n8n | >= 2.17.0 < 2.17.4 | 2.17.4 |
| n8n | n8n | >= 2.18.0 < 2.18.1 | 2.18.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
n8n-io n8n up to 1.123.31/2.17.3/2.18.0 Oracle Database Node Select Operation sql injection (GHSA-r6jc-mpqw-m755)
vuldb·2026-05-04·CVSS 5.3
CVE-2026-42233 [MEDIUM] n8n-io n8n up to 1.123.31/2.17.3/2.18.0 Oracle Database Node Select Operation sql injection (GHSA-r6jc-mpqw-m755)
A vulnerability was found in n8n-io n8n up to 1.123.31/2.17.3/2.18.0 and classified as critical. The impacted element is an unknown function of the component Oracle Database Node Select Operation. Executing a manipulation can lead to sql injection.
The identification of this vulnerability is CVE-2026-42233. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
n8n has SQL Injection in Oracle Database Node via Limit Field
ghsa·2026-04-29
CVE-2026-42233 [MEDIUM] CWE-20 n8n has SQL Injection in Oracle Database Node via Limit Field
n8n has SQL Injection in Oracle Database Node via Limit Field
## Impact
A flaw in the Oracle Database node's select operation allowed user-controlled input passed into the `Limit` field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the `Limit` field (e.g., from a webhook), an attacker could inject arbitrary SQL and exfiltrate data from the connected Oracle database.
Exploitation requires a specific workflow configuration:
- The Oracle Database node must be used with user-controlled input passed via expressions into the `Limit` field.
- Authentication requirements depend on the workflow's configuration (e.g., an unauthenticated webhook endpoint would allow unauthenticated exploitati
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-04
Published