CVE-2026-54310 is a critical SQL injection (CVSS 9.9 in the record) in n8n. A user who can create or edit workflows could supply crafted parameters to the TimescaleDB node and the legacy Postgres v1 node and run SQL within the privileges of the configured database account. It is fixed in 2.25.7 and 2.26.2.
What's affected
- n8n before 2.25.7 and before 2.26.2, per the record.
- Fixed in 2.25.7 and 2.26.2.
- Workflows that use the TimescaleDB node or the legacy Postgres v1 node.
How to check if you're exposed
Check the n8n version with the n8n version command or the container tag. Then find workflows that use these nodes. The node type names in the advisory are n8n-nodes-base.postgres and n8n-nodes-base.timescaleDb. Also list which database accounts those nodes use and what they can do. The injected SQL runs with that account's rights, so a narrow account limits the damage.
What to do now
- Upgrade to n8n 2.25.7, 2.26.2 or later.
- If you cannot upgrade, limit who can create or edit workflows, and consider adding n8n-nodes-base.postgres and n8n-nodes-base.timescaleDb to the NODES_EXCLUDE environment variable, both from the advisory.
- Reduce privileges on database accounts used by workflows to what each one needs.
- Review database logs for statements you do not recognize.
Why it matters
The class is CWE-89, improper neutralization of special elements in an SQL command. Parameters that should have been treated as data were allowed to change the structure of a query.
The attacker here already needs permission to build workflows, so this is mostly a risk where many people can edit workflows or where workflow data comes from outside. The record does not mark the CVE as exploited in the wild. The advisory warns that its workarounds do not fully remove the risk.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does NODES_EXCLUDE fix it?
It is a stopgap. The advisory says the workarounds do not fully remediate the risk, so upgrade.
Sources
Last reviewed: 19 October 2026.
