{"id":"GHSA-2x68-96jw-5r6c","kind":"vulnerability","aliases":["GHSA-2x68-96jw-5r6c"],"related":[],"title":"SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node","description":"## Impact\r\n\r\nThe Vector Store (OracleDB) node did not validate Metadata Filter keys, allowing SQL injection into the vector search query. In workflows where untrusted input (e.g., from a webhook) is passed into the filter key, an attacker could read data accessible to the configured Oracle credential.\r\n\r\n## Patches\r\n\r\nThe issue has been fixed in n8n versions 2.44.1, 2.43.5 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\r\n\r\n## Workarounds\r\n\r\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\r\n- Restrict n8n instance access to fully trusted users only.\r\n- Audit active workflows that use the Vector Store (OracleDB) node and ensure the Metadata Filter Name field does not incorporate untrusted external data via expressions.\r\n- Apply network-level controls to restrict access to webhook endpoints that feed into these workflows.\r\n- Deactivate affected workflows until the instance is patched.\r\n\r\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"The Vector Store (OracleDB) node in n8n does not validate Metadata Filter keys, so they are inserted into the vector search SQL query. When a workflow passes untrusted input such as a webhook payload into that filter key, an attacker can read data the configured Oracle credential can access.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 2.44.1"],"affected":"< 2.44.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.43.5"],"affected":"< 2.43.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","n8n","oracle","self-hosted","vector-store","webhook"],"not_affected_if":["filter-key-static","no-oracledb-vector-store-node","patched-version"],"how_to_check":"- Check the n8n version with `n8n --version` or the instance settings; versions below `2.44.1`, `2.43.5` and `3.0.1` on their respective lines are affected.\n- Search active workflows for the Vector Store (OracleDB) node and check whether its Metadata Filter Name field uses expressions fed by webhook or other external data.","fix":"- n8n `2.44.1` (2.x line)\n- n8n `2.43.5` (2.43 line)\n- n8n `3.0.1` (3.x line)","status":"open","published_at":"2026-10-28T08:48:57+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:57:01+00:00","updated_at":"2026-11-09T22:57:01+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:57:01Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.44.1` (2.x line)\n- n8n `2.43.5` (2.43 line)\n- n8n `3.0.1` (3.x line)","reach":"internet","title":"n8n: Oracle vector store metadata filter key allows SQL injection","impact":"medium","summary":"The Vector Store (OracleDB) node in n8n does not validate Metadata Filter keys, so they are inserted into the vector search SQL query. When a workflow passes untrusted input such as a webhook payload into that filter key, an attacker can read data the configured Oracle credential can access.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","oracle","vector-store","webhook"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads data accessible to the configured Oracle credential","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the instance settings; versions below `2.44.1`, `2.43.5` and `3.0.1` on their respective lines are affected.\n- Search active workflows for the Vector Store (OracleDB) node and check whether its Metadata Filter Name field uses expressions fed by webhook or other external data.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-oracledb-vector-store-node","filter-key-static","patched-version"],"who_is_affected":"Only n8n instances that run workflows using the Vector Store (OracleDB) node where the Metadata Filter key takes untrusted input, typically from a webhook. Instances without that node or without external data reaching the filter key are not exposed through this path. The advisory's workarounds are short-term only: restrict access, audit workflows, limit webhook exposure or deactivate the affected workflows until patched.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000838,"input_tokens":4944,"output_tokens":687,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'2.43.5':143C '2.44.1':142C '2x68':15A,20A '3.0.1':145C '5r6c':17A,22A '96jw':16A,21A 'access':86B,127C,177C,215C 'activ':184C 'administr':167C 'affect':225C 'ai':27B 'ai-tool':26B 'allow':99C 'appli':208C 'attack':77B,123C 'audit':183C 'configur':82B,130C 'consid':169C 'control':212C 'could':124C 'credenti':84B,132C 'data':80B,126C,205C 'deactiv':224C 'e.g':112C 'endpoint':218C 'ensur':194C 'express':207C 'extern':204C 'feed':220C 'field':199C 'filter':5A,49B,74B,97C,120C,197C 'fix':138C 'follow':171C 'fulli':179C,236C 'ghsa':14A,19A 'ghsa-2x68-96jw-5r6c':13A,18A 'host':33B 'immedi':165C 'impact':87C 'incorpor':202C 'inject':2A,101C 'input':66B,111C 'insert':54B 'instanc':176C,229C 'issu':135C 'key':6A,50B,75B,98C,121C 'later':155C 'level':211C 'measur':250C 'metadata':4A,48B,96C,196C 'mitig':173C,249C 'n8n':23A,24A,25A,29B,44B,140C,175C 'name':198C 'network':210C 'network-level':209C 'node':12A,42B,92C,192C 'one':150C 'oracl':30B,83B,131C 'oracledb':11A,41B,91C,191C 'pass':64B,117C 'patch':133C,231C 'payload':71B 'possibl':166C 'queri':60B,106C 'read':79B,125C 'remedi':157C,237C 'restrict':174C,214C 'risk':239C 'search':58B,105C 'self':32B 'self-host':31B 'short':247C 'short-term':246C 'sql':1A,59B,100C 'store':10A,36B,40B,90C,190C 'temporari':172C 'term':248C 'tool':28B 'trust':180C 'untrust':65B,110C,203C 'upgrad':148C,162C 'use':187C,244C 'user':146C,181C 'valid':47B,95C 'vector':9A,35B,39B,57B,89C,104C,189C 'vector-stor':34B 'version':141C,153C 'via':3A,206C 'vulner':159C 'webhook':37B,70B,115C,217C 'workaround':160C,233C 'workflow':63B,108C,185C,223C,226C","nicknames":[],"mitigations":[],"who_affected":"Only n8n instances that run workflows using the Vector Store (OracleDB) node where the Metadata Filter key takes untrusted input, typically from a webhook. Instances without that node or without external data reaching the filter key are not exposed through this path. The advisory's workarounds are short-term only: restrict access, audit workflows, limit webhook exposure or deactivate the affected workflows until patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","medium","n8n","npm","oracle","selfhosted","vectorstore","webhook"],"campaign_type":null,"search_a":"'2x68':15A,20A '5r6c':17A,22A '96jw':16A,21A 'filter':5A 'ghsa':14A,19A 'ghsa-2x68-96jw-5r6c':13A,18A 'inject':2A 'key':6A 'metadata':4A 'n8n':23A,24A,25A 'node':12A 'oracledb':11A 'sql':1A 'store':10A 'vector':9A 'via':3A","search_b":"'access':86B 'ai':27B 'ai-tool':26B 'attack':77B 'configur':82B 'credenti':84B 'data':80B 'filter':49B,74B 'host':33B 'input':66B 'insert':54B 'key':50B,75B 'metadata':48B 'n8n':29B,44B 'node':42B 'oracl':30B,83B 'oracledb':41B 'pass':64B 'payload':71B 'queri':60B 'read':79B 'search':58B 'self':32B 'self-host':31B 'sql':59B 'store':36B,40B 'tool':28B 'untrust':65B 'valid':47B 'vector':35B,39B,57B 'vector-stor':34B 'webhook':37B,70B 'workflow':63B","search_c":"'2.43.5':143C '2.44.1':142C '3.0.1':145C 'access':127C,177C,215C 'activ':184C 'administr':167C 'affect':225C 'allow':99C 'appli':208C 'attack':123C 'audit':183C 'configur':130C 'consid':169C 'control':212C 'could':124C 'credenti':132C 'data':126C,205C 'deactiv':224C 'e.g':112C 'endpoint':218C 'ensur':194C 'express':207C 'extern':204C 'feed':220C 'field':199C 'filter':97C,120C,197C 'fix':138C 'follow':171C 'fulli':179C,236C 'immedi':165C 'impact':87C 'incorpor':202C 'inject':101C 'input':111C 'instanc':176C,229C 'issu':135C 'key':98C,121C 'later':155C 'level':211C 'measur':250C 'metadata':96C,196C 'mitig':173C,249C 'n8n':140C,175C 'name':198C 'network':210C 'network-level':209C 'node':92C,192C 'one':150C 'oracl':131C 'oracledb':91C,191C 'pass':117C 'patch':133C,231C 'possibl':166C 'queri':106C 'read':125C 'remedi':157C,237C 'restrict':174C,214C 'risk':239C 'search':105C 'short':247C 'short-term':246C 'sql':100C 'store':90C,190C 'temporari':172C 'term':248C 'trust':180C 'untrust':110C,203C 'upgrad':148C,162C 'use':187C,244C 'user':146C,181C 'valid':95C 'vector':89C,104C,189C 'version':141C,153C 'via':206C 'vulner':159C 'webhook':115C,217C 'workaround':160C,233C 'workflow':108C,185C,223C,226C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-2x68-96jw-5r6c","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c","severity":"medium","published_at":"2026-10-28T08:48:57+00:00","modified_at":"2026-10-29T08:44:02+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110624,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}