CVE-2026-33713: SQL Injection in n8n Workflow Automation

The SQL Injection vulnerability in n8n's Data Table Get node allows an attacker to inject arbitrary SQL queries. On SQLite databases, the impact is limited to single-statement manipulation. However, on PostgreSQL deployments, the attacker can execute multiple SQL statements, granting them the ability to read, modify, and delete data within the database. This could lead to complete data compromise, including sensitive user information, workflow configurations, and potentially even system credentials if stored in the database. The ability to modify workflows could also allow an attacker to inject malicious code into automated processes, leading to further system compromise and data exfiltration. A successful exploit could effectively grant an attacker full control over the n8n instance and its associated data.

1. Reserved2026-03-23
2. Published2026-03-26
3. EPSS updated2026-04-02

The primary mitigation for CVE-2026-33713 is to upgrade n8n to version 1.123.26 or later, or to version 2.13.3 or 2.14.1. If immediate upgrade is not feasible, consider restricting user permissions to limit the ability to create or modify workflows. While not a complete fix, implementing a Web Application Firewall (WAF) with SQL Injection protection rules can provide an additional layer of defense. Carefully review and validate all user inputs within workflows to prevent malicious code from being injected. Monitor database logs for suspicious SQL queries, particularly those originating from workflow executions.