CVE-2026-72750 is a SQL injection in the n8n Snowflake node's Execute Query operation. The record scores it high (CVSS 8.8), while the GitHub advisory labels it medium. Upgrade to n8n 1.123.67, 2.31.5 or 2.32.1, and use the new Query Parameters field.
What's affected
n8n before 1.123.67 on the 1.x line, 2.0.0 release candidates up to before 2.31.5, and 2.32.0 before 2.32.1, per the GitHub advisory. Fixed in 1.123.67, 2.31.5 and 2.32.1.
The weakness is CWE-89. The Execute Query operation interpolated expression values directly into the SQL string. Exploitation requires that a workflow author has already placed untrusted, externally controlled expression data directly into a raw SQL query. The fix adds an optional Query Parameters field that binds values through positional placeholders.
Severity differs by source. The record scores 8.8 high with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The GitHub advisory lists the severity as medium. The difference is likely the precondition that a workflow already embeds untrusted data, which the base score does not weigh. Plan according to your own workflows.
How to check if you're exposed
Find the n8n version:
n8n --version
For Docker, read the image tag. Compare it with the three fixed versions.
Then find the workflows that matter. Search your workflows for Snowflake nodes using Execute Query, and read the query field for expressions that pull in data from webhooks, forms, emails or other external sources. You can export workflows and search the JSON:
n8n export:workflow --all --output=workflows.json
grep -c 'n8n-nodes-base.snowflake' workflows.json
Each match is a candidate for review. free in-browser dependency scan checks package manifests for known vulnerabilities, including n8n itself.
What to do now
- Check the n8n version and upgrade to 1.123.67, 2.31.5 or 2.32.1, depending on your line.
- Find Snowflake Execute Query nodes whose SQL contains expressions fed by external data.
- Move those values into the new Query Parameters field and use positional placeholders in the SQL.
- Limit workflow creation and editing to trusted users, as the advisory suggests.
- Restrict network access to webhook and trigger endpoints that feed Snowflake nodes.
Why it matters
CWE-89 is a design problem more than a version problem. Even after you upgrade, a workflow that builds SQL by pasting values into a string is still injectable. The fix gives authors a safe tool, Query Parameters, but it is up to them to use it.
Low code tools make this easy to miss. A workflow reads a field from a webhook, drops it into a query with an expression, and works in testing. The data crosses a trust boundary without anyone noticing. Review workflows the way you would review code that touches a database.
Quick check
Does upgrading remove the risk completely?
No. Upgrading adds the safe option, but existing workflows still build SQL by interpolation until you change them to use Query Parameters.
Sources
Last reviewed: 18 October 2026.
