CVE-2026-33713

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could exploit a SQL injection vulnerability in the Data Table Get node. On default SQLite DB, single statements can be manipulated and the attack surface is practically limited. On PostgreSQL deployments, multi-statement execution is possible, enabling data modification and deletion. The issue has been fixed in n8n versions 1.123.26, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, disable the Data Table node by adding `n8n-nodes-base.dataTable` to the `NODES_EXCLUDE` environment variable, and/or review existing workflows for Data Table Get nodes where `orderByColumn` is set to an expression that incorporates external or user-supplied input. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

• CWE-89

• https://github.com/n8n-io/n8n/security/advisories/GHSA-98c2-4cr3-4jc3Mitigation, Vendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33708Chamilo LMS is a learning management system. Prior to 1.11.3…6.5
• CVE-2026-33709JupyterHub is software that allows one to create a multi-use…6.1
• CVE-2026-3371The Tutor LMS – eLearning and online course solution plugin …4.3
• CVE-2026-33710Chamilo LMS is a learning management system. Prior to 1.11.3…7.5
• CVE-2026-33711Incus is a system container and virtual machine manager. Inc…7.8
• CVE-2026-33712Typebot is a chatbot builder tool. In versions 3.15.2 and pr…10
• CVE-2026-33714Chamilo is an open-source learning management system (LMS). …7.2
• CVE-2026-33715Chamilo LMS is an open-source learning management system. In…7.2
• CVE-2026-33716WWBN AVideo is an open source video platform. In versions up…9.4
• CVE-2026-33717WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33718OpenHands is software for AI-driven development. Starting in…9.9
• CVE-2026-33719WWBN AVideo is an open source video platform. In versions up…8.6