GHSA-jqwr-vx3p-r266: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
Summary
The PostgresTrigger node in n8n had a SQL injection vulnerability (a type of attack where an attacker tricks an application into running unintended database commands) that allowed authenticated users to execute arbitrary SQL commands on connected PostgreSQL databases. An attacker could exploit this to read or modify all data in the database.
Solution / Mitigation
The issue has been fixed in n8n versions 1.123.67, 2.31.5 and 2.32.1. Users should upgrade to these versions or later. If upgrading is not immediately possible, temporary mitigations include: restricting n8n instance access to fully trusted users only, disabling the PostgresTrigger node by adding `n8n-nodes-base.postgresTrigger` to the `NODES_EXCLUDE` environment variable, and ensuring PostgreSQL credentials are configured with minimum required privileges and do not use SUPERUSER roles. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-jqwr-vx3p-r266
First tracked: July 22, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 92%