n8n SQL Injection Microsoft SQL Node: What GHSA-5qpp-pqww-h7fp Means
This article explains the n8n SQL injection Microsoft SQL node advisory GHSA-5qpp-pqww-h7fp, published September 30, 2026, and what to do now.
Checked against the cited sources on .
What the n8n SQL Injection Microsoft SQL Node Advisory States (September 30, 2026)
GitHub's official security advisory database published a new n8n SQL injection Microsoft SQL node entry on September 30, 2026, tracked as GHSA-5qpp-pqww-h7fp. The listing states that the vulnerability sits in n8n's Microsoft SQL node and results from expression interpolation into the query field, and GitHub rates the severity as High. The entry credits a contributor named Matsuuu with the report.
This advisory page functions as a listing entry rather than a full write-up: it names the title, the GHSA identifier, the publish date, the severity rating and the reporting contributor. The detailed advisory body describing exact impact, exploitation conditions or proof-of-concept steps is not present in what we could retrieve, so this article cannot summarize content that simply isn't there.
Sources: Security Advisories · n8n-io/n8n · GitHub
Background: What Expression Interpolation Into the Query Field Means
n8n's own documentation describes the Microsoft SQL node as a way to run SQL queries and to insert, update or delete rows in Microsoft SQL databases from inside a workflow.
In n8n, an expression lets someone building a workflow insert a dynamic value, such as data from a webhook, a form or a previous node, into a field instead of typing a fixed value. When a query field accepts an expression and the resolved value is interpolated directly into the SQL text sent to the database, unescaped input can change the structure of that query. This explanation is the article's own general description of that mechanism, commonly called an n8n expression interpolation vulnerability, and is not detail drawn from the advisory body itself. The GHSA-5qpp-pqww-h7fp title names this exact mechanism for the Microsoft SQL node.
Sources: Security Advisories · n8n-io/n8n · GitHub, Microsoft SQL | Nodes | n8n Docs
Who the Advisory Affects, and What Remains Unstated
The advisory's public listing names the Microsoft SQL node in n8n as the affected component and rates the issue High severity. In what we retrieved, it does not list which n8n versions ship the vulnerable code path or which version first fixes it.
This n8n GitHub security announcement does not state, in what we retrieved, whether n8n Cloud customers are automatically protected or whether exposure is limited to self-hosted instances; no source we found addresses that cloud-versus-self-hosted scope question.
Sources: Security Advisories · n8n-io/n8n · GitHub
What the Advisory Does Not Say
Several details a team would normally check before triaging a High-severity finding are missing from what we could retrieve for the n8n SQL injection Microsoft SQL node advisory:
- Affected version range: not stated in what we retrieved
- Patched version: also absent from the retrieved material
- CVSS score or vector: not given here, unlike the CVE entry a separate, earlier advisory later received
- CVE identifier: none listed for this advisory in what we retrieved
- Official workaround or mitigation: none described for this advisory in what we retrieved
Sources: Security Advisories · n8n-io/n8n · GitHub, NVD-CVE-2026-56351
What Readers Should Do Now
The suggestions below are this article's own editorial judgment, not steps stated by the advisory itself.
Anyone who finds or suspects a related issue can report it through n8n's Vulnerability Disclosure Program, described on the project's official security overview page, though that reporting channel doesn't itself confirm details of this specific advisory.
Sources: Overview · n8n-io/n8n · GitHub
How This Fits With n8n's Other Recent SQL Injection Advisories
This isn't the first Microsoft SQL node vulnerability n8n has disclosed in 2026. An earlier advisory, published February 25, 2026, described a different SQL injection issue affecting the Microsoft SQL, MySQL and PostgreSQL nodes, caused by unescaped identifier values such as table or column names rather than by query-field expression interpolation.
For that earlier issue, n8n described temporarily disabling the affected nodes through an environment variable as a stopgap while a patch was prepared, not as a permanent fix.
That February 2026 issue later received a formal CVE entry, in the U.S. National Vulnerability Database, months after its GitHub advisory first went live. No CVE status is stated for the September 30, 2026 advisory in the sources we could retrieve, so the two should not be treated as the same finding.
| Advisory | Published | Root cause | CVE stated |
|---|---|---|---|
| GHSA-f3f2-mcxc-pwjx | Feb 25, 2026 | Unescaped table/column identifier values | Yes, added later |
| GHSA-5qpp-pqww-h7fp | Sep 30, 2026 | Expression interpolation into the query field | Not stated in retrieved sources |
Sources: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes · Advisory · n8n-io/n8n · GitHub, NVD-CVE-2026-56351
Where to Check for Updates on This Advisory
n8n's official security overview page describes a Vulnerability Disclosure Program through which researchers and users can report suspected vulnerabilities. That page's guidance is about reporting new issues, not about this advisory's fix timeline.
Tracking the n8n SQL injection Microsoft SQL node advisory going forward mainly means watching one page: the GHSA-5qpp-pqww-h7fp entry itself, where n8n would be expected to add the affected-version list, the patched release and any official workaround as the advisory is completed.
Sources: Overview · n8n-io/n8n · GitHub, Security Advisories · n8n-io/n8n · GitHub
