CVE-2026-42229: 
NixOS vulnerability analysis and mitigation

CVE-2026-42229 is a SQL injection vulnerability in the SeaTable node of n8n, an open-source workflow automation platform. The flaw exists in the row:search and row:get operations, where user-controlled input is concatenated directly into SQL query strings without escaping or parameterization. Affected versions include all n8n releases before 1.123.32, versions 2.0.0 through 2.17.3, and version 2.18.0. The vulnerability was published on April 22, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium) and a CVSS v3.1 score of 8.8 (High) (GitHub Advisory, n8n Security Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the SeaTable node constructs SQL queries by directly concatenating user-supplied values into query strings without sanitization or parameterized queries. Exploitation requires a specific workflow configuration: the SeaTable node must be in use, and user-controlled input (e.g., from a form or webhook trigger) must be passed via n8n expressions into the searchTerm or rowId parameters of row:search or row:get operations. An attacker with the ability to supply input to such a workflow can craft malicious SQL fragments that alter the intended query logic, causing the database to return rows that should be restricted by the workflow's filtering logic (GitHub Advisory, n8n Security Advisory).

Successful exploitation allows an attacker to bypass row-level filtering logic implemented in n8n workflows and retrieve arbitrary, unintended rows from the connected SeaTable base. The primary impact is on confidentiality and integrity of data stored in SeaTable — sensitive records that should be inaccessible to the attacker can be exposed or manipulated. The vulnerability does not directly impact availability of the n8n system itself, but data exposure from connected SeaTable bases could have significant downstream consequences depending on the sensitivity of the stored data (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires low privileges (the attacker must be able to supply input to a vulnerable workflow, e.g., via a public form or webhook) and a specific workflow configuration involving the SeaTable node with unsanitized expression inputs. The EPSS score is approximately 0.063% (20th percentile), indicating a low near-term exploitation probability. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability (GitHub Advisory).

1. Identify a vulnerable target: Locate an n8n instance running a version prior to 1.123.32, 2.17.4, or 2.18.1 that exposes a workflow using the SeaTable node with a public-facing form or webhook trigger.
2. Analyze the workflow input: Determine which input fields (e.g., form fields or webhook parameters) are passed via n8n expressions into the SeaTable node's searchTerm or rowId parameters in row:search or row:get operations.
3. Craft a SQL injection payload: Construct a malicious input string that breaks out of the intended SQL query context, such as appending SQL logic (e.g., ' OR '1'='1) to the searchTerm value to manipulate the WHERE clause and return all rows regardless of filtering.
4. Submit the payload: Send the crafted input through the exposed form or webhook endpoint, triggering the vulnerable SeaTable node to execute the manipulated SQL query against the connected SeaTable base.
5. Retrieve unintended data: Observe the workflow response or output to collect rows from the SeaTable base that should have been restricted by the workflow's row-level filtering logic (GitHub Advisory, n8n Security Advisory).

• Logs: n8n workflow execution logs showing unexpected or anomalous values in SeaTable node searchTerm or rowId parameters, particularly inputs containing SQL metacharacters such as single quotes ('), OR, AND, --, or UNION.
• Network: Unusual volume of SeaTable API queries originating from n8n, or responses returning significantly more rows than expected for a given workflow execution.
• Application Behavior: Workflow outputs containing data records that should be restricted by row-level filters, or SeaTable node returning a larger-than-expected dataset for a given search term.

Upgrade n8n to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1 (or any later release). If an immediate upgrade is not feasible, the following temporary mitigations should be applied: (1) restrict workflow creation and editing permissions to fully trusted users only; (2) disable the SeaTable node by adding n8n-nodes-base.seaTable to the NODES_EXCLUDE environment variable; (3) avoid passing unvalidated external user input into SeaTable node search or row retrieval parameters via expressions. Note that these workarounds do not fully remediate the risk and should only be used as short-term measures until patching is possible (GitHub Advisory, n8n Security Advisory).

The vulnerability was reported by security researcher sm1ee and disclosed by n8n maintainer Jubke via GitHub Security Advisories on April 22, 2026. The advisory was picked up by standard vulnerability tracking services including Qualys, Tenable, and INCIBE-CERT shortly after publication, indicating routine industry monitoring but no significant public controversy or widespread media coverage (GitHub Advisory).