{"id":"CVE-2026-126381","kind":"vulnerability","aliases":["CVE-2026-126381"],"related":[],"title":"n8n: Oracle vector store node lets crafted webhook input read database data","description":"n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential.","summary":"The Vector Store (OracleDB) node in n8n does not validate metadata filter keys used in vector search queries, enabling SQL injection. An attacker who can send crafted input, such as through a webhook feeding a workflow, can read data reachable by the configured Oracle credential.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","n8n","oracle","self-hosted","webhooks"],"not_affected_if":["no-oracledb-node","trusted-input-only"],"how_to_check":"- Check the n8n version with `n8n --version` and compare against the fixed ranges below.\n- Look for workflows that use the Vector Store (OracleDB) node and take input from webhooks or other untrusted sources.","fix":"- n8n `2.43.5` for the 2.43.x line\n- n8n `2.44.1` for the 2.44.x line\n- n8n `3.0.1` for the 3.x line","status":"open","published_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:55:23+00:00","updated_at":"2026-11-13T10:55:23+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:55:23Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.43.5` for the 2.43.x line\n- n8n `2.44.1` for the 2.44.x line\n- n8n `3.0.1` for the 3.x line","reach":"internet","title":"n8n: Oracle vector store node lets crafted webhook input read database data","impact":"medium","summary":"The Vector Store (OracleDB) node in n8n does not validate metadata filter keys used in vector search queries, enabling SQL injection. An attacker who can send crafted input, such as through a webhook feeding a workflow, can read data reachable by the configured Oracle credential.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","oracle","webhooks"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads data accessible to the Oracle credential","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` and compare against the fixed ranges below.\n- Look for workflows that use the Vector Store (OracleDB) node and take input from webhooks or other untrusted sources.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-oracledb-node","trusted-input-only"],"who_is_affected":"Teams running self-hosted or cloud n8n that use the Vector Store (OracleDB) node in workflows fed by untrusted input such as webhooks. The flaw reads data the configured Oracle credential can access, so the exposure depends on what that credential can reach. Installations without this node in their workflows are not affected by this report.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4649,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126381':15A,18A '-2026':14A,17A '2.43.5':75C '2.44':76C '2.44.1':79C '3':81C '3.0.1':84C 'access':124C 'ai':20B 'ai-tool':19B 'attack':50B,108C 'configur':70B,127C 'contain':85C 'craft':7A,54B,111C 'credenti':72B,129C 'cve':13A,16A 'data':12A,66B,123C 'databas':11A 'enabl':46B 'feed':61B 'filter':39B,101C,112C 'host':26B 'inject':48B,88C 'input':9A,55B,117C 'key':40B,102C,113C 'let':6A 'metadata':38B,100C 'n8n':1A,22B,34B,73C 'node':5A,32B,95C 'oracl':2A,23B,71B,128C 'oracledb':31B,94C 'queri':45B,107C 'reachabl':67B 'read':10A,65B,122C 'search':44B,106C 'self':25B 'self-host':24B 'send':53B 'sql':47B,87C 'store':4A,30B,93C 'suppli':110C 'tool':21B 'untrust':115C 'use':41B,103C 'valid':37B,99C 'vector':3A,29B,43B,92C,105C 'vulner':89C 'webhook':8A,27B,60B,120C 'workflow':63B,116C 'x':77C,82C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted or cloud n8n that use the Vector Store (OracleDB) node in workflows fed by untrusted input such as webhooks. The flaw reads data the configured Oracle credential can access, so the exposure depends on what that credential can reach. Installations without this node in their workflows are not affected by this report.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","medium","n8n","oracle","selfhosted","webhooks"],"campaign_type":null,"search_a":"'-126381':15A,18A '-2026':14A,17A 'craft':7A 'cve':13A,16A 'data':12A 'databas':11A 'input':9A 'let':6A 'n8n':1A 'node':5A 'oracl':2A 'read':10A 'store':4A 'vector':3A 'webhook':8A","search_b":"'ai':20B 'ai-tool':19B 'attack':50B 'configur':70B 'craft':54B 'credenti':72B 'data':66B 'enabl':46B 'feed':61B 'filter':39B 'host':26B 'inject':48B 'input':55B 'key':40B 'metadata':38B 'n8n':22B,34B 'node':32B 'oracl':23B,71B 'oracledb':31B 'queri':45B 'reachabl':67B 'read':65B 'search':44B 'self':25B 'self-host':24B 'send':53B 'sql':47B 'store':30B 'tool':21B 'use':41B 'valid':37B 'vector':29B,43B 'webhook':27B,60B 'workflow':63B","search_c":"'2.43.5':75C '2.44':76C '2.44.1':79C '3':81C '3.0.1':84C 'access':124C 'attack':108C 'configur':127C 'contain':85C 'craft':111C 'credenti':129C 'data':123C 'filter':101C,112C 'inject':88C 'input':117C 'key':102C,113C 'metadata':100C 'n8n':73C 'node':95C 'oracl':128C 'oracledb':94C 'queri':107C 'read':122C 'search':106C 'sql':87C 'store':93C 'suppli':110C 'untrust':115C 'use':103C 'valid':99C 'vector':92C,105C 'vulner':89C 'webhook':120C 'workflow':116C 'x':77C,82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126381","severity":null,"published_at":"2026-11-13T10:17:40+00:00","modified_at":"2026-11-13T10:17:41+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null}],"documents":[{"id":110624,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-28T08:48:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145005,"url":"https://www.vulncheck.com/advisories/n8n-before-2.44.1-sql-injection-via-vector-store-oracledb-metadata-filter-key","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}