AI Threat Alert
n8n's Postgres Trigger node builds SQL statements by directly interpolating user-supplied channel, function, and trigger names, so any authenticated n8n user can inject arbitrary SQL that runs with the full privileges of the configured database credential. For organizations running n8n as their AI agent orchestration layer, this matters because the node sits inside automated workflows with standing database access — a malicious or compromised internal user can pivot straight to full read/write control of the connected PostgreSQL instance, and with 16 downstream npm dependents and n8n's OpenSSF Scorecard at 6.6/10, the exposure extends across the automation supply chain. There's no CVSS score published, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as a disclosure-driven fix rather than something under active attack — but the underlying flaw (CWE-89) is trivial to weaponize once a PoC circulates. Patch to n8n 1.123.67, 2.31.5, or 2.32.1 now; if you can't patch immediately, exclude the node via NODES_EXCLUDE=n8n-nodes-base.postgresTrigger, restrict instance access to trusted users, and confirm the Postgres credentials used by n8n are scoped to least privilege rather than SUPERUSER.
What is the risk?
Medium severity per the vendor advisory, but exploitation requires authentication — an attacker needs an existing n8n account with permission to configure the Postgres Trigger node, which caps the threat to malicious insiders, compromised credentials, or multi-tenant n8n deployments where workflow authors aren't fully trusted. If exploited, impact is severe: full read/write access to the connected PostgreSQL database with whatever privileges the configured credential holds. No EPSS score, CISA KEV listing, public exploit, or scanner template currently exists, indicating this is not yet under active exploitation, but the vulnerability class is textbook SQL injection requiring no AI/ML-specific expertise — time-to-exploit after a public PoC is likely short.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | < 1.123.67 | 1.123.67 |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step-
Upgrade to n8n 1.123.67, 2.31.5, or 2.32.1 (or later) immediately — these versions properly escape identifier parameters before building SQL statements. If immediate upgrade isn't possible, add n8n-nodes-base.postgresTrigger to the NODES_EXCLUDE environment variable to disable the node entirely, restrict n8n instance access to fully trusted users, and ensure PostgreSQL credentials configured in n8n use least-privilege roles rather than SUPERUSER so a successful injection can't escalate beyond intended scope. For detection, review PostgreSQL logs for anomalous DDL/DML tied to trigger, channel, or function names containing SQL metacharacters, and audit which n8n users can edit Postgres Trigger nodes.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is GHSA-jqwr-vx3p-r266?
n8n's Postgres Trigger node builds SQL statements by directly interpolating user-supplied channel, function, and trigger names, so any authenticated n8n user can inject arbitrary SQL that runs with the full privileges of the configured database credential. For organizations running n8n as their AI agent orchestration layer, this matters because the node sits inside automated workflows with standing database access — a malicious or compromised internal user can pivot straight to full read/write control of the connected PostgreSQL instance, and with 16 downstream npm dependents and n8n's OpenSSF Scorecard at 6.6/10, the exposure extends across the automation supply chain. There's no CVSS score published, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as a disclosure-driven fix rather than something under active attack — but the underlying flaw (CWE-89) is trivial to weaponize once a PoC circulates. Patch to n8n 1.123.67, 2.31.5, or 2.32.1 now; if you can't patch immediately, exclude the node via NODES_EXCLUDE=n8n-nodes-base.postgresTrigger, restrict instance access to trusted users, and confirm the Postgres credentials used by n8n are scoped to least privilege rather than SUPERUSER.
Is GHSA-jqwr-vx3p-r266 actively exploited?
No confirmed active exploitation of GHSA-jqwr-vx3p-r266 has been reported, but organizations should still patch proactively.
How to fix GHSA-jqwr-vx3p-r266?
Upgrade to n8n 1.123.67, 2.31.5, or 2.32.1 (or later) immediately — these versions properly escape identifier parameters before building SQL statements. If immediate upgrade isn't possible, add n8n-nodes-base.postgresTrigger to the NODES_EXCLUDE environment variable to disable the node entirely, restrict n8n instance access to fully trusted users, and ensure PostgreSQL credentials configured in n8n use least-privilege roles rather than SUPERUSER so a successful injection can't escalate beyond intended scope. For detection, review PostgreSQL logs for anomalous DDL/DML tied to trigger, channel, or function names containing SQL metacharacters, and audit which n8n users can edit Postgres Trigger nodes.
What systems are affected by GHSA-jqwr-vx3p-r266?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, data pipelines.
What is the CVSS score for GHSA-jqwr-vx3p-r266?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012 Valid Accounts AML.T0053 AI Agent Tool Invocation AML.T0081 Modify AI Agent Configuration Compliance Controls Affected
What are the technical details?
Original Advisory
## Impact The Postgres Trigger node interpolated user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges. Successful exploitation allows full read and write access to the connected PostgreSQL database. ## Patches The issue has been fixed in n8n versions 1.123.67, 2.31.5 and 2.32.1. Users should upgrade to these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Disable the PostgresTrigger node by adding `n8n-nodes-base.postgresTrigger` to the `NODES_EXCLUDE` environment variable. - Ensure PostgreSQL credentials used with n8n are configured with the minimum required privileges and do not use SUPERUSER roles. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Exploitation Scenario
An authenticated n8n user with workflow-edit permission creates or modifies a Postgres Trigger node, entering a malicious payload — e.g. a channel name like `chan'; DROP TABLE users; --` or a trigger name containing a subquery — into the channel/function/trigger name fields instead of a legitimate identifier. When the workflow saves or activates the trigger, n8n interpolates that value directly into the SQL statement it issues to PostgreSQL without escaping, so the injected SQL executes with the full privileges of the credential configured for that connection. Since Postgres Trigger nodes commonly kick off agentic workflows in response to database events, the attacker gains a path to read arbitrary tables, exfiltrate other users' data, or modify records across the entire connected database without ever needing direct database access of their own.
Weaknesses (CWE)
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
- [Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-33663 10.0 n8n: member role steals plaintext HTTP credentials
Same package: n8n CVE-2026-33660 10.0 TensorFlow: type confusion NPD in tensor conversion
Same package: n8n CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same package: n8n CVE-2026-27577 9.9 n8n: Code Injection enables RCE
Same package: n8n CVE-2026-27494 9.9 n8n: security flaw enables exploitation
Same package: n8n