CVE-2026-42229 - Vulnerability Analysis

Overview

n8n < 1.123.32, 2.17.4, 2.18.1 contains a SQL injection caused by unescaped user input concatenated into SQL queries in SeaTable node's row:search and row:get operations, letting attackers bypass row-level filtering to retrieve unintended data, exploit requires external user input passed via expressions.

Severity & Score

Impact

Attackers can retrieve unintended rows from SeaTable bases, bypassing row-level filtering and exposing sensitive data.

Mitigation

Update to versions 1.123.32, 2.17.4, 2.18.1 or later.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-mp4j-h6gh-f6mp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner