CVE-2026-59257

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.

• CWE-89

• https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9Mitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolationThird Party Advisory

Published

Jul 8, 2026

Last Modified

Jul 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59250Classic buffer overflow in the Erlang/OTP megaco flex scanne…8.3
• CVE-2026-59251Allocation of resources without limits in Erlang/OTP public_…7.5
• CVE-2026-59252Improper Validation of Specified Quantity in Input in ZenHiv…8.2
• CVE-2026-59253n8n before 2.28.0 contains an improper authorization vulnera…5
• CVE-2026-59254n8n before 2.28.1 contains an information disclosure vulnera…6.3
• CVE-2026-59255BloodHound through 9.4.0, fixed in commit 8f79035, contains …7.1
• CVE-2026-59258immich before 3.0.3 contains a broken access control vulnera…8.3
• CVE-2026-59259n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a …6.5
• CVE-2026-5926IBM Verify Identity Access Container 11.0 through 11.0.2 and…6.5
• CVE-2026-59260OpenWrt luci-app-samba4 read ACL grants file.exec permission…8.8
• CVE-2026-59261OpenClaw before 2026.5.28 contains a credential exposure vul…6.5
• CVE-2026-59262AFFiNE's histories GraphQL field fails to validate Doc.Read …7.1