AI Threat AlertCVE-2026-126381: n8n: SQL injection in OracleDB vector store filter
MEDIUMn8n's Vector Store (OracleDB) node does not validate Metadata Filter keys, so attacker-controlled input reaching a workflow, for example through a webhook, can inject SQL and read any data the configured Oracle credential can see. The CVSS score of 6.3 (medium) reflects high attack complexity and the need for low privileges. The scope change and high confidentiality impact matter, because the Oracle account often reaches far more than the vector store itself. There is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing, so there is no sign of active exploitation yet. Upgrade to n8n 2.43.5, 2.44.1 or 3.0.1 or later, and until then restrict the OracleDB credential to least privilege and stop passing untrusted input into Metadata Filter keys.
What is the risk?
Medium overall. The attack is network-reachable and needs no user interaction, but it has high complexity and requires low privileges, which in practice means the ability to feed input into a workflow that uses the OracleDB vector store. Impact is limited to confidentiality (C:H, I:N, A:N), but the changed scope means data outside the vector store may be exposed, depending on the Oracle account's grants. Exposure is highest where webhook-triggered workflows pass user-controlled filter keys straight into the node. There are no exploitation signals (no EPSS data, no public PoC, no KEV listing), so near-term likelihood looks low to moderate. Because SQL injection is a well-understood class, this could change quickly once the advisory is analyzed.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 2.43.5, 2.44.1, 3.0.1 or later. 2) Until patched, remove or disable the Vector Store (OracleDB) node in workflows that accept untrusted input, or hard-code the Metadata Filter keys. 3) Allow-list filter keys in a validation step before the node, and reject any key that is not alphanumeric or is not on the approved list. 4) Reduce the Oracle credential to least privilege, with read-only access to only the required vector table. 5) Restrict and authenticate webhook endpoints. 6) Detect by reviewing Oracle audit logs for unusual queries, syntax errors or access to unexpected tables from the n8n service account, and by inspecting webhook payloads for SQL metacharacters in filter key fields.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126381?
n8n's Vector Store (OracleDB) node does not validate Metadata Filter keys, so attacker-controlled input reaching a workflow, for example through a webhook, can inject SQL and read any data the configured Oracle credential can see. The CVSS score of 6.3 (medium) reflects high attack complexity and the need for low privileges. The scope change and high confidentiality impact matter, because the Oracle account often reaches far more than the vector store itself. There is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing, so there is no sign of active exploitation yet. Upgrade to n8n 2.43.5, 2.44.1 or 3.0.1 or later, and until then restrict the OracleDB credential to least privilege and stop passing untrusted input into Metadata Filter keys.
Is CVE-2026-126381 actively exploited?
No confirmed active exploitation of CVE-2026-126381 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126381?
1) Upgrade n8n to 2.43.5, 2.44.1, 3.0.1 or later. 2) Until patched, remove or disable the Vector Store (OracleDB) node in workflows that accept untrusted input, or hard-code the Metadata Filter keys. 3) Allow-list filter keys in a validation step before the node, and reject any key that is not alphanumeric or is not on the approved list. 4) Reduce the Oracle credential to least privilege, with read-only access to only the required vector table. 5) Restrict and authenticate webhook endpoints. 6) Detect by reviewing Oracle audit logs for unusual queries, syntax errors or access to unexpected tables from the n8n service account, and by inspecting webhook payloads for SQL metacharacters in filter key fields.
What systems are affected by CVE-2026-126381?
This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, vector databases, workflow automation platforms.
What is the CVSS score for CVE-2026-126381?
CVE-2026-126381 has a CVSS v3.1 base score of 6.3 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0036Data from Information RepositoriesAML.T0049Exploit Public-Facing ApplicationAML.T0085.000RAG DatabasesCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential.
Exploitation Scenario
An organization runs an n8n RAG workflow with a public webhook that accepts a question and optional metadata filters, then queries an OracleDB vector store. An attacker with low-privilege access to the workflow sends a crafted filter key containing SQL syntax. Because the key is placed into the query without validation, the injected SQL runs under the configured Oracle credential. The attacker then uses it to extract records from tables outside the vector store, such as customer data or credentials, and returns them through the workflow response or through error messages.
Weaknesses (CWE)
CWE-89Improper Neutralization of Special Elements used in an SQL CommandPrimaryCWE-89Improper Neutralization of Special Elements used in an SQL CommandCWE-89 — Improper Neutralization of Special Elements used in an SQL Command: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
- [Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n