n8n: OData $filter injection vulnerability (CVE-2026-118641)
n8n workflow nodes for Microsoft Outlook and SharePoint contain an OData $filter injection vulnerability allowing unauthorized data access and modification.
CVE search metadata
CVE search record: CVE-2026-118641. Severity: high. CVSS: 7.5. KEV: no. Product: n8n (< 1.123.85), n8n (2.x < 2.43.5), n8n (2.44.x < 2.44.1), n8n (< 1.123.85, 2.43.5, 2.44.1), n8n (< 2.43.5, 2.44.x < 2.44.1), n8n (< 1.123.83, < 2.41.4, < 2.42.1). Brief: n8n: OData $filter injection vulnerability (CVE-2026-118641). Brief link: https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/
CVE search record: CVE-2026-118642. Severity: high. CVSS: 7.1. KEV: no. Product: n8n (< 1.123.85), n8n (2.x < 2.43.5), n8n (2.44.x < 2.44.1), n8n (< 1.123.85, 2.43.5, 2.44.1), n8n (< 2.43.5, 2.44.x < 2.44.1), n8n (< 1.123.83, < 2.41.4, < 2.42.1). Brief: n8n: OData $filter injection vulnerability (CVE-2026-118641). Brief link: https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/
CVE search record: CVE-2026-118643. Severity: high. CVSS: 8.2. KEV: no. Product: n8n (< 1.123.85), n8n (2.x < 2.43.5), n8n (2.44.x < 2.44.1), n8n (< 1.123.85, 2.43.5, 2.44.1), n8n (< 2.43.5, 2.44.x < 2.44.1), n8n (< 1.123.83, < 2.41.4, < 2.42.1). Brief: n8n: OData $filter injection vulnerability (CVE-2026-118641). Brief link: https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/
CVE search record: CVE-2026-118645. Severity: high. CVSS: 8.7. KEV: no. Product: n8n (< 1.123.85), n8n (2.x < 2.43.5), n8n (2.44.x < 2.44.1), n8n (< 1.123.85, 2.43.5, 2.44.1), n8n (< 2.43.5, 2.44.x < 2.44.1), n8n (< 1.123.83, < 2.41.4, < 2.42.1). Brief: n8n: OData $filter injection vulnerability (CVE-2026-118641). Brief link: https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/
CVE search record: CVE-2026-118649. Severity: high. CVSS: 8.3. KEV: no. Product: n8n (< 1.123.85), n8n (2.x < 2.43.5), n8n (2.44.x < 2.44.1), n8n (< 1.123.85, 2.43.5, 2.44.1), n8n (< 2.43.5, 2.44.x < 2.44.1), n8n (< 1.123.83, < 2.41.4, < 2.42.1). Brief: n8n: OData $filter injection vulnerability (CVE-2026-118641). Brief link: https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/
CVE search record: CVE-2026-118679. Severity: high. CVSS: 7.5. KEV: no. Product: n8n (< 1.123.85), n8n (2.x < 2.43.5), n8n (2.44.x < 2.44.1), n8n (< 1.123.85, 2.43.5, 2.44.1), n8n (< 2.43.5, 2.44.x < 2.44.1), n8n (< 1.123.83, < 2.41.4, < 2.42.1). Brief: n8n: OData $filter injection vulnerability (CVE-2026-118641). Brief link: https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/
Triage facts
Revision 1- Applicability
- n8n (< 1.123.85), n8n (2.x < 2.43.5) +4
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 6 public sources
- Freshness
- Revision 1Oct 28, 20:38 UTC
- Vulnerabilities
- 6 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for n8n (< 1.123.83, < 2.41.4, < 2.42.1) Oct 28, 20:38 via nvd
- 2. added coverage for n8n (< 2.43.5, 2.44.x < 2.44.1) Oct 28, 20:38 via nvd
- 3. added CVE-2026-118645 Oct 28, 20:38 via nvd
- 4. added coverage for n8n (< 1.123.85) +2 products Oct 28, 20:38 via nvd
- 5. added coverage for n8n (< 1.123.85, 2.43.5, 2.44.1) Oct 28, 20:38 via nvd
CVE-2026-118641 is an OData $filter injection vulnerability in n8n affecting the Microsoft Outlook contact lookup node and the Microsoft SharePoint v1 item update node. The nodes fail to escape expression-bindable parameters when constructing $filter strings, enabling attackers to inject single quotes. Successful exploitation allows for the unauthorized retrieval of contact lists from a mailbox or the manipulation of write operations to target unintended SharePoint list items within the scope of the configured credentials.
Impact
An attacker can perform unauthorized exfiltration of mailbox contacts or manipulate SharePoint item updates. The scope of impact is limited to the permissions of the credentials configured within the n8n workflow.
Recommendation
Update n8n to the patched versions immediately. The fixed versions are 1.123.85, 2.43.5, and 2.44.1. For environments where patching must be deferred, audit active n8n workflows that utilize the Microsoft Outlook contact lookup or Microsoft SharePoint v1 item update nodes to ensure inputs are not derived from untrusted user-controllable sources.
Immediate actions
Patch n8n instances to versions 1.123.85, 2.43.5, 2.44.1 or later.
Patch n8n instances to versions >= 1.123.85, 2.43.5, or 2.44.1
Upgrade n8n instances to the specified fixed versions: 1.123.85, 2.43.5, or 2.44.1.
Upgrade n8n instances to 2.43.5 or 2.44.1 to patch CVE-2026-118649.
Upgrade n8n to version 1.123.83, 2.41.4, or 2.42.1
Threat Hunt
Identify n8n workflows utilizing Microsoft Outlook contact lookup or SharePoint v1 item update nodes that accept external user input.
Data: n8n workflow configurations (JSON/YAML exported workflows)
Identify unauthorized access to sensitive credentials via Execute Workflow node modifications
Data: n8n application logs, Audit logs showing node configuration changes
Search n8n internal execution logs for error messages containing common credential patterns associated with Git, MongoDB, or Google Cloud nodes.
Data: n8n execution log export, Workflow error history
Identify authenticated users submitting API requests with workflow IDs containing "__proto__" or similar prototype pollution patterns.
Data: n8n application logs, web server access logs
Identify outbound HTTP requests from n8n instances to non-Slack domains
Data: Application egress logs / proxy logs
Mitigations
Upgrade n8n to 1.123.85 or later
CVE-2026-118641
Apply security patches for CVE-2026-118642
CVE-2026-118642
Restrict access to workflow execution history for non-privileged users.
CVE-2026-118643
Upgrade n8n to 2.43.5 or later
CVE-2026-118649
Configure Slack signing secrets for all webhooks
CVE-2026-118679