CVE-2026-42233: 
NixOS vulnerability analysis and mitigation

CVE-2026-42233 is a SQL injection vulnerability in the n8n open-source workflow automation platform, specifically in the Oracle Database node's select operation. User-controlled input passed into the Limit field via expressions is interpolated directly into SQL queries without sanitization or parameterization. The vulnerability affects n8n versions prior to 1.123.32, versions 2.0.0–2.17.3, and version 2.18.0. It was first published on April 22, 2026, and disclosed publicly on April 29, 2026. The CVSS v3.1 base score is 9.8 (Critical), while the CVSS v4.0 score is 5.3 (Medium) reflecting specific attack requirements (GitHub Advisory, n8n Security Advisory).

The root cause is improper input validation (CWE-20) and SQL injection (CWE-89): the Oracle Database node's select operation directly interpolates the Limit field value — which can be set via n8n expressions — into the raw SQL query string without using parameterized queries or sanitizing the input. An attacker who can influence the value passed to the Limit field (e.g., via a webhook that feeds external data into the expression) can inject arbitrary SQL statements. Exploitation requires a specific workflow configuration where the Oracle Database node is in use and external input is routed into the Limit field via expressions; authentication requirements vary depending on whether the triggering endpoint (e.g., a webhook) is publicly accessible. The vulnerability was reported by researcher pawbednarz (GitHub Advisory, n8n Security Advisory).

Successful exploitation allows an attacker to inject arbitrary SQL commands into the connected Oracle database, enabling exfiltration of sensitive data stored in that database. The primary impact is on confidentiality and integrity of the downstream Oracle database system; the n8n application itself is not directly compromised in terms of availability. In workflows exposed via unauthenticated webhook endpoints, exploitation requires no credentials, making data exfiltration accessible to any network-reachable attacker (GitHub Advisory, n8n Security Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.063% (20th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is conditional on a specific workflow configuration, which limits the attack surface compared to a universally exploitable flaw. Qualys has added detection for this vulnerability (Qualys).

1. Reconnaissance: Identify publicly accessible n8n instances running vulnerable versions (< 1.123.32, 2.0.0–2.17.3, or 2.18.0) using tools like Shodan or Censys, searching for n8n web interfaces or webhook endpoints.
2. Identify target workflow: Locate or infer an n8n workflow that uses the Oracle Database node with a Limit field populated via an expression sourced from external input (e.g., a webhook parameter).
3. Craft malicious payload: Construct a SQL injection payload intended for the Limit field. Since the field expects a numeric limit, a payload such as 1 UNION SELECT username, password FROM users-- or similar Oracle-compatible injection can be used to append additional SQL logic.
4. Trigger the webhook: Send an HTTP request to the workflow's webhook endpoint with the crafted payload as the value that will be passed into the Limit expression field (e.g., as a query parameter or JSON body field).
5. Exfiltrate data: The injected SQL executes against the connected Oracle database, and the results are returned through the workflow's normal output, allowing the attacker to read arbitrary database contents (GitHub Advisory, n8n Security Advisory).

• Network: Unusual or unexpected HTTP requests to n8n webhook endpoints containing SQL syntax (e.g., UNION SELECT, --, OR 1=1) in parameters that map to the Oracle Database node's Limit field; anomalous outbound connections from the n8n host to external IPs following webhook invocations.
• Logs: n8n execution logs showing Oracle Database node executions with non-numeric or unexpectedly complex values in the Limit field; Oracle database audit logs recording unusual SELECT queries with UNION clauses or other injection patterns originating from the n8n service account.
• Database: Unexpected queries in Oracle's V$SQL or audit trail views containing injected SQL fragments; queries returning data from tables not normally accessed by the n8n workflow.

Upgrade n8n to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1 (or later). If immediate upgrading is not possible, apply the following temporary mitigations: restrict workflow creation and editing permissions to fully trusted users only; disable the Oracle Database node by adding n8n-nodes-base.oracleDatabase to the NODES_EXCLUDE environment variable; and avoid passing unvalidated external user input into the Oracle Database node's Limit field via expressions. Note that these workarounds do not fully remediate the risk and should only be used as short-term measures (n8n Security Advisory, GitHub Advisory).

The vulnerability was reported by security researcher pawbednarz and disclosed through GitHub's security advisory process. Red Hat has acknowledged the CVE in their security tracking (Red Hat CVE). Qualys added detection coverage for the vulnerability in May 2026 (Qualys). A technical blog post analyzing the vulnerability was published at cveo.tech, providing additional context on the Oracle SQL injection in n8n workflows.