CVE-2026-42237: 
NixOS vulnerability analysis and mitigation

CVE-2026-42237 is a SQL injection vulnerability in n8n, an open-source workflow automation platform, affecting the Snowflake node and the legacy MySQL v1 node. It represents an incomplete fix for a prior SQL injection issue (GHSA-f3f2-mcxc-pwjx) that failed to address these two nodes. Affected versions include all n8n releases prior to 1.123.32, versions 2.0.0–2.17.3, and version 2.18.0. The vulnerability was published on April 22, 2026, and received a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 5.3 (Medium/Moderate) (GitHub Advisory, n8n Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where both the Snowflake node and the legacy MySQL v1 node directly interpolate user-controlled values — including table names, column names, and update keys — into SQL query strings without proper identifier escaping. Exploitation requires a specific workflow configuration in which these nodes receive user-controlled input via n8n expressions (e.g., sourced from a form submission or webhook payload) into identifier fields. An authenticated low-privilege user who can create or edit workflows can craft malicious input that breaks out of the intended SQL identifier context and injects arbitrary SQL commands against the connected downstream database (GitHub Advisory, n8n Advisory).

Successful exploitation allows an authenticated attacker to perform SQL injection against the Snowflake or MySQL database connected to the vulnerable n8n workflow, enabling data exfiltration, unauthorized data modification, or data deletion. The primary impact is on the downstream (subsequent) database system, with high confidentiality and integrity impact on that system. Availability of the downstream database may also be affected depending on the injected payload, and sensitive business data stored in connected databases is at risk of exposure or corruption (GitHub Advisory, n8n Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.037% (11th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (workflow creation/editing access) and a specific workflow configuration involving user-controlled input passed into identifier fields of the affected nodes.

1. Gain access: Obtain a low-privilege n8n account with permission to create or edit workflows on a vulnerable n8n instance (version < 1.123.32, 2.0.0–2.17.3, or 2.18.0).
2. Identify target nodes: Locate or create a workflow that uses the Snowflake node or the legacy MySQL v1 node connected to a target database.
3. Configure expression-based input: Set up the workflow so that a user-controlled input source (e.g., a webhook or form trigger) feeds data into an identifier field — such as table name, column name, or update key — of the vulnerable node using an n8n expression (e.g., {{ $json.tableName }}).
4. Craft malicious payload: Submit a request to the workflow trigger (e.g., webhook endpoint) with a payload containing SQL injection syntax in the identifier field, such as legitimate_table; DROP TABLE sensitive_data; -- or a UNION-based payload to exfiltrate data.
5. Trigger workflow execution: The n8n workflow executes, and the vulnerable node interpolates the unsanitized identifier directly into the SQL query string, causing the injected SQL to execute against the connected Snowflake or MySQL database.
6. Achieve objective: Depending on the payload, the attacker can exfiltrate sensitive records, modify or delete data, or potentially escalate further within the database environment (GitHub Advisory, n8n Advisory).

• Logs: n8n workflow execution logs showing unexpected or malformed table/column names containing SQL syntax characters (e.g., semicolons, quotes, UNION, SELECT, DROP) in Snowflake or MySQL v1 node parameters.
• Database Logs: Snowflake or MySQL query logs containing anomalous SQL statements with injected clauses, unexpected UNION SELECT queries, or DDL statements (e.g., DROP, ALTER) originating from the n8n service account.
• Network: Unusual outbound data transfers from the database server following n8n workflow executions, potentially indicating data exfiltration.
• Application: n8n workflow configurations where the Snowflake or MySQL v1 node identifier fields (table name, column name, update key) are populated via expressions referencing external input sources such as webhooks or forms.

Upgrade n8n to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1 (or later). If immediate upgrade is not possible, the following temporary mitigations should be applied: (1) restrict workflow creation and editing permissions to fully trusted users only; (2) migrate affected workflows from the legacy MySQL v1 node to the MySQL v2 node, which already implements identifier escaping; (3) disable the Snowflake node by adding n8n-nodes-base.snowflake to the NODES_EXCLUDE environment variable; (4) avoid passing unvalidated external user input into table name, column name, or update key fields via expressions in the affected nodes. These workarounds do not fully remediate the risk and should only be used as short-term measures (GitHub Advisory, n8n Advisory).

The vulnerability was credited to researcher offensiveee and published by n8n maintainer Jubke on April 22, 2026. Qualys included detection for this CVE in its May 2026 application security detections release. Coverage has been picked up by standard vulnerability tracking platforms including Tenable, VulnDB, and INCIBE-CERT, but no significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).