{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-118641/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118641"},{"cvss":7.1,"id":"CVE-2026-118642"},{"cvss":8.2,"id":"CVE-2026-118643"},{"cvss":8.7,"id":"CVE-2026-118645"},{"cvss":8.3,"id":"CVE-2026-118649"},{"cvss":7.5,"id":"CVE-2026-118679"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["n8n (\u003c 1.123.85)","n8n (2.x \u003c 2.43.5)","n8n (2.44.x \u003c 2.44.1)","n8n (\u003c 1.123.85, 2.43.5, 2.44.1)","n8n (\u003c 2.43.5, 2.44.x \u003c 2.44.1)","n8n (\u003c 1.123.83, \u003c 2.41.4, \u003c 2.42.1)"],"_cs_severities":["high"],"_cs_tags":["injection","n8n","cve-2026-118641","authorization-bypass","cve-2026-118642","vulnerability","credential-access","cloud","privilege-escalation","cve-2026-118649","web-vulnerability","ssrf","exfiltration"],"_cs_type":"advisory","_cs_vendors":["n8n GmbH","n8n"],"content_html":"\u003cp\u003eCVE-2026-118641 is an OData $filter injection vulnerability in n8n affecting the Microsoft Outlook contact lookup node and the Microsoft SharePoint v1 item update node. The nodes fail to escape expression-bindable parameters when constructing $filter strings, enabling attackers to inject single quotes. Successful exploitation allows for the unauthorized retrieval of contact lists from a mailbox or the manipulation of write operations to target unintended SharePoint list items within the scope of the configured credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can perform unauthorized exfiltration of mailbox contacts or manipulate SharePoint item updates. The scope of impact is limited to the permissions of the credentials configured within the n8n workflow.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate n8n to the patched versions immediately. The fixed versions are 1.123.85, 2.43.5, and 2.44.1. For environments where patching must be deferred, audit active n8n workflows that utilize the Microsoft Outlook contact lookup or Microsoft SharePoint v1 item update nodes to ensure inputs are not derived from untrusted user-controllable sources.\u003c/p\u003e\n","date_modified":"2026-10-28T20:38:57Z","date_published":"2026-10-28T20:38:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/","summary":"n8n workflow nodes for Microsoft Outlook and SharePoint contain an OData $filter injection vulnerability allowing unauthorized data access and modification.","title":"n8n: OData $filter injection vulnerability (CVE-2026-118641)","url":"https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-118641","version":"https://jsonfeed.org/version/1.1"}