CVE-2026-42233 is an SQL injection flaw in the select operation of the n8n Oracle Database node, scored CVSS 9.8 (critical) in the record. Input passed into the Limit field through expressions was not parameterized. Upgrade to n8n 1.123.32, 2.17.4 or 2.18.1.
What's affected
n8n versions before 1.123.32, before 2.17.4 and before 2.18.1 are affected, depending on your release line. The fixed versions are 1.123.32, 2.17.4 and 2.18.1.
The advisory adds a condition. Exploitation needs a workflow that uses the Oracle Database node with user controlled input in the Limit field through an expression, for example from a webhook. Whether an attacker needs a login depends on how that workflow is exposed.
How to check if you're exposed
- Read your n8n version.
n8n --version
docker exec YOUR_CONTAINER n8n --version
- Find workflows that use the Oracle node. Export them and search for the node type name.
n8n export:workflow --all --output=workflows.json
grep -c "n8n-nodes-base.oracleDatabase" workflows.json
- For each hit, check whether the Limit field is filled from a webhook, form or other outside input.
What to do now
- Upgrade to 1.123.32, 2.17.4 or 2.18.1, whichever matches your line.
- If you cannot upgrade yet, add
n8n-nodes-base.oracleDatabaseto theNODES_EXCLUDEenvironment variable, as the advisory suggests. The advisory says this is only a short term measure. - Limit who can create and edit workflows to trusted users.
- Validate any outside value before it reaches a database node, and use a fixed number for Limit where you can.
Why it matters
The class is CWE-89. The node placed the Limit value into the SQL text as is, so a crafted value could change the query and read data from the connected Oracle database. A number field is easy to forget when people think about injection, because it looks harmless.
The n8n advisory rates it moderate, since it needs that specific workflow shape. The NVD score assumes a reachable, unauthenticated case. The KEV flag is false, and I found no report of exploitation in the wild.
Try it yourself
A code scan can flag query strings built from request values, including number fields like this one.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect me if I do not use the Oracle node?
The flaw is in the Oracle Database node only, so workflows that never use it are not exposed to this one. Still upgrade, because the same releases fix other issues.
Sources
Last reviewed: 19 October 2026.
