Summary
n8n contains a high-severity SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. If an attacker can control the table or schema fields processed by this operation, they may cause arbitrary SQL statements to run against the connected database using the configured credential's privileges.
Affected context
The vulnerability occurs in n8n workflows that use the Oracle Database node's Delete Table Drop operation in affected n8n releases. Risk is present when attacker-influenced values can reach the operation's table or schema fields and the connected Oracle account has permission to execute the resulting database actions.
Exploit preconditions
- Attack surface: n8n's Oracle Database node and its Delete Table Drop operation
- Required access: Ability to influence workflow inputs, parameters, or another trusted data path that supplies the table or schema fields
- Trigger point: Execution of the database operation using those fields
- Why exploitation is possible: Input is incorporated into SQL without adequate parameterization or identifier handling, allowing database syntax to be altered
Why this happens
The underlying issue is insufficient separation between user-controlled values and SQL syntax when constructing an Oracle database statement. Single-quote characters and related input can change the intended query structure, allowing additional SQL statements or clauses to be interpreted by the database. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
Potential impact
- An attacker may execute unauthorized DDL or DML statements
- Database tables or schemas could be modified or deleted
- Sensitive data may be read, altered, or destroyed
- The connected database account's privileges could be abused
- Dependent workflows and business processes may be disrupted
General mitigation guidance
Mitigation generally focuses on preventing input from being interpreted as SQL syntax and reducing the privileges available to automation credentials.
Common defensive patterns include:
- Use parameterized database operations wherever values are accepted
- Validate and constrain table and schema identifiers against trusted allowlists
- Avoid assembling SQL statements through string concatenation
- Separate identifier handling from value binding using database-aware APIs
- Apply least privilege to Oracle credentials used by workflows
- Restrict which users and workflows can configure or execute database operations
- Treat workflow data and external inputs as untrusted by default
How teams detect issues like this
Organizations can look for SQL injection risk through:
- Static analysis rules identifying string concatenation or interpolation in SQL construction
- Code review checks for database identifiers and values that bypass validation or binding
- Tests using malformed input to verify that SQL structure cannot be changed
- Database audit logs showing unexpected DDL, DML, or statements issued by automation accounts
- Policy enforcement requiring parameterized queries and restricted database roles
Automated code review and application security testing tools may help identify unsafe query-building patterns.
