CVE-2026-126381

CVSS 6.3 (medium) · published 2026-11-13

n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential.

Weakness: CWE-89

Source: NVD CVE-2026-126381

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c
• https://www.vulncheck.com/advisories/n8n-before-2.44.1-sql-injection-via-vector-store-oracledb-metadata-filter-key

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.