CVE-2026-103253

{
  "etk_id": "ETK-2026-246",
  "cve_id": "CVE-2026-103253",
  "display_id": "CVE-2026-103253",
  "ghsa_id": "GHSA-4p39-vh7m-r689",
  "euvd_id": "EUVD-2026-90647",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in n8n Oracle Database node",
  "summary": "Affected n8n releases mishandle table or schema input in the Oracle Database node's Delete Table Drop operation. An attacker able to supply values to that operation can cause additional SQL to run against the connected Oracle database, limited by the database credential's permissions.",
  "mitigation": "Upgrade to n8n 1.123.80, 2.39.6, or 2.40.1, as applicable to your release line. Until upgraded, restrict access to affected workflows and use Oracle credentials with only the minimum required privileges.",
  "vendor": "n8n-io",
  "product": "n8n",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.123.80",
        ">= 2.0.0, < 2.39.6",
        ">= 2.40.0, < 2.40.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.123.80",
        "2.39.6",
        "2.40.1"
      ],
      "package_name": "n8n",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
  "epss_score": 0.0023,
  "epss_percentile": 0.1317,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 39.7599615,
  "t0_at": "2026-10-01T10:41:58.637000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T10:41:58.637000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T10:41:58.637000+00:00",
      "url": "https://github.com/advisories/GHSA-4p39-vh7m-r689"
    }
  }
}