n8n MySQL v1 Node SQL Injection via Unparameterized Expression Interpolation

Technical Analysis

The n8n MySQL v1 node's executeQuery operation performs naive string substitution of {{ ... }} expression outputs into the SQL query text rather than binding them as parameters. Because n8n workflows can be triggered by externally-facing nodes such as Webhook, any attacker-controlled data that flows into an expression used within the query becomes an injection point, effectively turning an agentic/automation tool call into an arbitrary SQL execution primitive scoped to the node's configured database credentials. This crosses a trust boundary between untrusted external HTTP input and a privileged downstream tool (the database connector), a common pattern in agent/tool-chaining architectures where tool inputs are not treated as adversarial. The MySQL v2 node is unaffected since it uses parameterized queries, confirming the root cause is implementation-specific rather than architectural to n8n as a whole.

Affected Systems

n8n, n8n-nodes-base.mySql

Detection Signatures

• Workflow definitions referencing n8n-nodes-base.mySql node type with operation=executeQuery and expression syntax ({{ }}) embedded directly in the query field
• Webhook-triggered workflows with unauthenticated public endpoints feeding data into MySQL v1 executeQuery nodes
• Database logs showing anomalous or malformed SQL syntax originating from n8n service account credentials
• Audit configuration for NODES_EXCLUDE not containing n8n-nodes-base.mySql on instances still using legacy node

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 1.123.61, 2.27.4, 2.28.1 or later, which contain the fix for this vulnerability.

2. 2

   Disable legacy MySQL node

   Add n8n-nodes-base.mySql to the NODES_EXCLUDE environment variable to prevent use of the vulnerable v1 node until upgraded.

3. 3

   Migrate to MySQL v2 node

   Update existing workflows to use the parameterized-query MySQL v2 node instead of v1's executeQuery operation.

4. 4

   Authenticate webhook triggers

   Require authentication on webhook endpoints that feed into workflows containing MySQL v1 executeQuery nodes to reduce attacker reachability.

5. 5

   Apply least privilege to DB credentials

   Ensure MySQL credentials configured in n8n have minimal privileges needed, limiting blast radius of any successful injection.