n8n hat Mehrere Remote Code Execution Schwachstellen im Merge Node AlaSQL SQL Modus

This vulnerability allows an authenticated user to execute arbitrary code on the n8n server. The attacker can exploit the "Combine by SQL" feature within the Merge node to craft malicious SQL queries that bypass the AlaSQL sandbox's intended security measures. Successful exploitation enables the attacker to read local files, potentially exposing sensitive data such as configuration files, API keys, and database credentials. Beyond data exfiltration, the attacker could leverage this access to install malware, create backdoors, or completely compromise the n8n instance and potentially pivot to other systems on the network. The impact is particularly severe given n8n's role in automating workflows, which often involve access to sensitive data and systems.

Organizations heavily reliant on n8n for workflow automation, particularly those with complex workflows involving data merging and SQL operations, are at significant risk. Shared hosting environments where multiple users have access to n8n instances are also vulnerable, as a compromised user could potentially exploit this vulnerability to impact other users on the same server.

• nodejs / server:

ps aux | grep n8n

• nodejs / server:

journalctl -u n8n -f | grep "AlaSQL sandbox"

• generic web:

curl -I http://your-n8n-instance/ | grep Server

1. 2026-03-25Disclosure

   disclosure

1. Reserviert2026-03-23
2. Veröffentlicht2026-03-25
3. Geändert2026-04-12
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade n8n to version 2.14.1, 2.13.3, or 1.123.27 or later. If immediate upgrading is not feasible, consider restricting the SQL access permissions for users who have workflow creation or modification privileges. Implement strict input validation and sanitization on any user-provided SQL queries. Review and audit existing workflows to identify and disable any workflows that utilize the "Combine by SQL" feature. Consider using a Web Application Firewall (WAF) to filter out malicious SQL queries. After upgrading, confirm the vulnerability is resolved by attempting to execute a known malicious SQL query within the Merge node and verifying that it is properly blocked.