---
id: "GHSA-2x68-96jw-5r6c"
page: "https://infrastack.ai/live/GHSA-2x68-96jw-5r6c"
kind: "vulnerability"
aliases: ["GHSA-2x68-96jw-5r6c"]
title: "SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "n8n", "fixed": [">= 2.44.1"], "affected": "< 2.44.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.43.5"], "affected": "< 2.43.5", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 3.0.1"], "affected": "< 3.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "n8n", "oracle", "self-hosted", "vector-store", "webhook"]
not_affected_if: ["filter-key-static", "no-oracledb-vector-store-node", "patched-version"]
published_at: "2026-10-28T08:48:57+00:00"
first_seen_at: "2026-11-09T22:53:25+00:00"
updated_at: "2026-11-09T22:57:01+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c", "first_seen_at": "2026-11-09T22:53:25+00:00"}]
exploit_sources: []
---

# SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node

Link for people: https://infrastack.ai/live/GHSA-2x68-96jw-5r6c (this .md is for agents)

The Vector Store (OracleDB) node in n8n does not validate Metadata Filter keys, so they are inserted into the vector search SQL query. When a workflow passes untrusted input such as a webhook payload into that filter key, an attacker can read data the configured Oracle credential can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 2.44.1 fixed >= 2.44.1
- npm:n8n affected < 2.43.5 fixed >= 2.43.5
- npm:n8n affected < 3.0.1 fixed >= 3.0.1

## How to check

- Check the n8n version with `n8n --version` or the instance settings; versions below `2.44.1`, `2.43.5` and `3.0.1` on their respective lines are affected.
- Search active workflows for the Vector Store (OracleDB) node and check whether its Metadata Filter Name field uses expressions fed by webhook or other external data.

## Fix

- n8n `2.44.1` (2.x line)
- n8n `2.43.5` (2.43 line)
- n8n `3.0.1` (3.x line)

## Timeline

- 2026-11-09T22:53:25+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c

## From the sources

## Impact

The Vector Store (OracleDB) node did not validate Metadata Filter keys, allowing SQL injection into the vector search query. In workflows where untrusted input (e.g., from a webhook) is passed into the filter key, an attacker could read data accessible to the configured Oracle credential.

## Patches

The issue has been fixed in n8n versions 2.44.1, 2.43.5 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit active workflows that use the Vector Store (OracleDB) node and ensure the Metadata Filter Name field does not incorporate untrusted external data via expressions.
- Apply network-level controls to restrict access to webhook endpoints that feed into these workflows.
- Deactivate affected workflows until the instance is patched.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_