6.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54310

CVE-2026-54310: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54310

CVE-2026-54310:

6.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	>= 2.26.0, < 2.26.2	2.26.2
n8n	npm	< 2.25.7	2.25.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability was a SQL injection in the Postgres and TimescaleDB nodes of n8n. The execute method in both nodes used user-provided table and schema names to construct SQL queries without proper sanitization. This allowed an authenticated user with permission to create or modify workflows to execute arbitrary SQL commands against the connected database. The patch for this vulnerability introduced a sanitize function that escapes double quotes and wraps the table and schema names in double quotes, thus preventing the database from interpreting them as SQL commands. The vulnerable functions are PostgresV1.execute and TimescaleDb.execute as they are the entry points for the vulnerable code execution.

Vulnerable functions

PostgresV1.execute

packages/nodes-base/nodes/Postgres/V1/PostgresV1.node.ts

The `execute` method in the `PostgresV1` node was vulnerable to SQL injection because it used user-provided input to construct a SQL query without proper sanitization. An attacker could provide a crafted table name to execute arbitrary SQL commands.

TimescaleDb.execute

packages/nodes-base/nodes/TimescaleDB/TimescaleDb.node.ts

The `execute` method in the `TimescaleDb` node was vulnerable to SQL injection because it used user-provided input to construct a SQL query without proper sanitization. An attacker could provide a crafted table name to execute arbitrary SQL commands.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.