{"schema":"threatline.record/2","record":{"id":"GHSA-4v22-g448-h4rg","aliases":["GHSA-4v22-g448-h4rg"],"summary":"MongoDB Node Update Operations Can Modify Unintended Documents","details":"## Impact\n\nIn the MongoDB node's Update and Find And Replace operations, the update key value taken from the incoming item was not sufficiently validated. Where a workflow passes untrusted input, such as a webhook body, to one of these operations, a caller could make the node match and overwrite documents other than the one the workflow intended, or insert new documents.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit active workflows that use the MongoDB node with Find And Replace or Update operations and ensure the `updateKey` value cannot be influenced by untrusted external data.\n- Apply network-level controls to restrict access to webhook endpoints that feed into MongoDB update workflows.\n- Disable the MongoDB node by adding `n8n-nodes-base.mongoDb` to the `NODES_EXCLUDE` environment variable if it is not required.\n- Deactivate affected workflows until the instance is patched.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg","source_modified_at":"2026-10-28T08:48:23Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.89"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg","source_modified_at":"2026-10-28T08:48:23Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.46.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg","source_modified_at":"2026-10-28T08:48:23Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.45.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg","source_modified_at":"2026-10-28T08:48:23Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 3.0.1"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T08:48:23Z","modified_at":"2026-10-28T08:48:23Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T08:48:23Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T08:48:23Z","content_hash":"4e74b74ece70bbf333923fb83d0672656b1956b0721e8e3738231713d49d97a5"}}