CVE-2026-110840: n8n: SQL injection in MSSQL node v1 Query field

HIGH

Published October 14, 2026

CISO Take

n8n's Microsoft SQL node (version 1) inserts Query field expression values straight into SQL text without parameterisation. Any workflow that maps untrusted input, such as webhook fields, into that field lets an unauthenticated caller run arbitrary SQL with the privileges of the stored database credential. n8n is widely used as an AI agent and automation orchestrator, so these workflows often sit in front of production databases. Exploitation likelihood is unquantified: no CVSS or EPSS score has been assigned, the CVE is not in CISA KEV, and no public exploit or Nuclei template exists. That is only the state at publication on 2026-10-14, and SQL injection through a public webhook is trivial to weaponise once details circulate. Upgrade to n8n 2.41.4 or 2.42.1 or later, and until then inventory workflows that use MSSQL node v1 with webhook-fed expressions and restrict the credential's database permissions.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Risk should be treated as high pending an official score. The attack needs no authentication when the workflow exposes a public webhook, uses standard SQL injection (CWE-89), and can reach the full privileges of the stored database credential. It applies only where a workflow binds untrusted input to the Query field of MSSQL node version 1, which limits the affected population. No active exploitation, KEV listing, public exploit or scanner template is known at publication. Confidence in these facts is MEDIUM because there is no CVSS or EPSS data yet and the details come from the vendor advisory and VulnCheck.

How does the attack unfold?

Initial Access

Attacker sends a crafted request to a public n8n webhook whose fields feed the Microsoft SQL node v1 Query expression.

AML.T0049

Exploitation

Unparameterised substitution places attacker-controlled SQL into the query text, which executes against the connected database.

AML.T0049

Collection

Attacker enumerates and reads tables using the stored credential's privileges.

AML.T0036

Impact

Sensitive data is exfiltrated or modified, and a privileged credential may allow further compromise of the database server.

Initial Access

Attacker sends a crafted request to a public n8n webhook whose fields feed the Microsoft SQL node v1 Query expression.

AML.T0049

Exploitation

Unparameterised substitution places attacker-controlled SQL into the query text, which executes against the connected database.

AML.T0049

Collection

Attacker enumerates and reads tables using the stored credential's privileges.

AML.T0036

Impact

Sensitive data is exfiltrated or modified, and a privileged credential may allow further compromise of the database server.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

7 steps

Upgrade n8n to 2.41.4 or later on the 2.41 line, or to 2.42.1 or later on the 2.42 line.
Until patched, find workflows using the Microsoft SQL node version 1 and check whether the Query field contains expressions fed by webhooks, forms, chat triggers or LLM output.
Migrate those nodes to a newer node version or to parameterised queries, and validate or sanitise inputs upstream.
Reduce the stored SQL credential to least privilege (read-only where possible, no xp_cmdshell or admin roles).
Require authentication on webhook endpoints and restrict network exposure of the n8n instance.
Detect abuse by reviewing SQL Server logs and n8n execution history for unusual queries, UNION or stacked statements, and unexpected webhook payloads.
Rotate the database credentials if exploitation is suspected.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData ExtractionAgentFrameworkPluginAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are planned and documented

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-110840?

Is CVE-2026-110840 actively exploited?

No confirmed active exploitation of CVE-2026-110840 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110840?

1. Upgrade n8n to 2.41.4 or later on the 2.41 line, or to 2.42.1 or later on the 2.42 line. 2. Until patched, find workflows using the Microsoft SQL node version 1 and check whether the Query field contains expressions fed by webhooks, forms, chat triggers or LLM output. 3. Migrate those nodes to a newer node version or to parameterised queries, and validate or sanitise inputs upstream. 4. Reduce the stored SQL credential to least privilege (read-only where possible, no xp_cmdshell or admin roles). 5. Require authentication on webhook endpoints and restrict network exposure of the n8n instance. 6. Detect abuse by reviewing SQL Server logs and n8n execution history for unusual queries, UNION or stacked statements, and unexpected webhook payloads. 7. Rotate the database credentials if exploitation is suspected.

What systems are affected by CVE-2026-110840?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Workflow automation pipelines, RAG pipelines, LLM tool-calling backends.

What is the CVSS score for CVE-2026-110840?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Agent frameworksWorkflow automation pipelinesRAG pipelinesLLM tool-calling backends

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.

Exploitation Scenario

An attacker finds a public n8n webhook that triggers a customer-support or data-lookup agent workflow. The workflow places a field from the request body, such as a customer ID, into the Query field of a Microsoft SQL node v1. The attacker sends a payload that closes the intended statement and appends their own SQL, first enumerating tables, then dumping customer records or the data behind the agent's knowledge base. With a privileged credential, they can also modify records or run server-side commands. They do all of this without authenticating to n8n.

Weaknesses (CWE)

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Primary CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]

Source: MITRE CWE corpus.