{"id":"CVE-2026-72775","aliases":[],"cve":{"records":[{"id":"CVE-2026-72775","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-10T15:09:12.955Z","published":"2026-08-11T12:17:13.395Z","modified":"2026-10-29T21:16:47.195Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-29T21:16:47.195Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-08-11T17:50:19.590Z"}],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-89","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*","versionEndExcluding":"1.123.67"},{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.32.1","versionStartIncluding":"2.32.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.31.5","versionStartIncluding":"2.0.0-rc.0"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-08-11T17:40:59.327653Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"n8n before 1.123.67 SQL Injection via PostgresTrigger Node","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.","score":5.8,"severity":"medium","published":"2026-08-11T12:17:13.395Z","modified":"2026-10-29T21:16:47.195Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"n8n-io","name":"n8n","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.123.67","versionType":"semver"},{"version":"1.123.67","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","packageIdentity":{"ecosystem":"npm","name":"n8n"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-72775"},{"vendor":"n8n-io","name":"n8n","platforms":[],"versions":[{"version":"2.32.0","status":"affected","lessThan":"2.32.1","versionType":"semver"},{"version":"2.32.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","packageIdentity":{"ecosystem":"npm","name":"n8n"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-72775"},{"vendor":"n8n-io","name":"n8n","platforms":[],"versions":[{"version":"2.0.0-rc.0","status":"affected","lessThan":"2.31.5","versionType":"semver"},{"version":"2.31.5","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","packageIdentity":{"ecosystem":"npm","name":"n8n"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-72775"}],"remediation":[],"references":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266","https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node"],"sources":[{"name":"CVE","id":"CVE-2026-72775","modified":"2026-10-29T21:16:47.195Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-72775"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","score":5.8}],"sourceAffected":[],"observedAt":"2026-10-29T21:37:22.880Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T22:15:32.115Z","attemptedAt":"2026-10-29T22:15:32.115Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T22:15:32.109Z","attemptedAt":"2026-10-29T22:15:32.109Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T22:15:32.115Z","attemptedAt":"2026-10-29T22:15:32.115Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T22:15:32.001Z","attemptedAt":"2026-10-29T22:15:32.001Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-72775","url":"https://www.first.org/epss/","probability":0.00471,"percentile":0.40711,"date":"2026-10-29","checkedAt":"2026-10-29T22:15:32.001Z"},{"source":"NVD","id":"CVE-2026-72775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72775","modified":"2026-10-29T21:17:31.843","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-29T22:15:32.115Z"},{"source":"NVD","id":"CVE-2026-72775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72775","modified":"2026-10-29T21:17:31.843","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T22:15:32.115Z"},{"source":"ENISA EUVD","id":"EUVD-2026-56101","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56101","modified":"Oct 29, 2026, 9:16:47 PM","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","checkedAt":"2026-10-29T22:15:32.115Z"},{"source":"GitHub Advisory Database","id":"GHSA-m6wx-qjxf-vr9v","url":"https://github.com/advisories/GHSA-m6wx-qjxf-vr9v","modified":"2026-09-03T18:31:25Z","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T22:15:32.109Z"}],"aiSummary":{"text":"n8n before versions 1.123.67, 2.31.5, and 2.32.1 has a SQL injection vulnerability in the PostgresTrigger node, allowing an authenticated user to inject arbitrary SQL. The vulnerability gives full read and write access to the connected PostgreSQL database. Affected versions include those less than 1.123.67, 2.31.5, and 2.32.1.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:30:45.508Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-72775"}]}}