All vulnerabilities
CVE-2026-118641GHSA-mgpr-56r4-5c67

n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

n8n-io n8nFrameworks
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.123.85Also 2.44.1, 2.43.5CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.

Text from CVE List

Affected versions 6

  • n8naffected: all versions before 1.123.85CVE List
  • n8nunaffected: 1.123.85CVE List
  • n8naffected: 2.44.0 before 2.44.1CVE List
  • n8nunaffected: 2.44.1CVE List
  • n8naffected: 2.0.0 before 2.43.5CVE List
  • n8nunaffected: 2.43.5CVE List

References 2