CVE-2026-44792 is a high severity SQL injection (CVSS 9.0 in the record) in n8n. A crafted Data Table file committed to a connected Git repository can inject SQL when an administrator runs a Source Control pull on a PostgreSQL backed instance. Upgrade to 1.123.43, 2.20.7 or 2.21.1.
What's affected
From the project advisory for the n8n npm package:
- Affected: before 1.123.43, before 2.20.7, and before 2.21.1.
- Fixed: 1.123.43, 2.20.7 and 2.21.1 or later.
The record text names 2.22.1 as the fixed version for the 2.22 line, while this advisory lists 2.21.1. Either is at or above the fix. All three conditions must be true: n8n uses PostgreSQL, Source Control is enabled and connected to a repository the attacker can write to, and an administrator pulls.
How to check if you're exposed
Check your n8n version and your database:
npm ls n8n
In the n8n settings, check whether Source Control is enabled, which repository it uses, and who has write access to that repository. Then check whether the instance uses PostgreSQL or SQLite.
What to do now
- Upgrade n8n to 1.123.43, 2.20.7 or 2.21.1 or later.
- Turn off Source Control if you do not actively use it.
- Restrict write access on the connected repository to fully trusted users.
- Avoid pulling from repositories that others may have changed, and review incoming changes first.
Why it matters
The class is CWE-89 (SQL injection). A column name from a file in the repository was used when n8n built SQL for its internal database. Names are easy to forget when people think about injection, because they are not values, but they can still carry SQL syntax if they are not quoted properly.
The attack depends on an administrator action, which is why the record shows user interaction required. The repository becomes a trust boundary. The record does not mark this CVE as KEV.
Quick check
Am I affected if I use SQLite?
The advisory says exploitation requires PostgreSQL as the backend.
Sources
Last reviewed: 19 October 2026.
