Cve-2026-118642 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-118642/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 20:38:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgn8n: OData $filter injection vulnerability (CVE-2026-118641)https://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/Wed, 28 Oct 2026 20:38:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-n8n-odata-injection/n8n workflow nodes for Microsoft Outlook and SharePoint contain an OData $filter injection vulnerability allowing unauthorized data access and modification.CVE-2026-118641 is an OData $filter injection vulnerability in n8n affecting the Microsoft Outlook contact lookup node and the Microsoft SharePoint v1 item update node. The nodes fail to escape expression-bindable parameters when constructing $filter strings, enabling attackers to inject single quotes. Successful exploitation allows for the unauthorized retrieval of contact lists from a mailbox or the manipulation of write operations to target unintended SharePoint list items within the scope of the configured credentials.

Impact

An attacker can perform unauthorized exfiltration of mailbox contacts or manipulate SharePoint item updates. The scope of impact is limited to the permissions of the credentials configured within the n8n workflow.

Recommendation

Update n8n to the patched versions immediately. The fixed versions are 1.123.85, 2.43.5, and 2.44.1. For environments where patching must be deferred, audit active n8n workflows that utilize the Microsoft Outlook contact lookup or Microsoft SharePoint v1 item update nodes to ensure inputs are not derived from untrusted user-controllable sources.

]]>highadvisoryinjectionn8ncve-2026-118641authorization-bypasscve-2026-118642vulnerabilitycredential-accesscloudprivilege-escalationcve-2026-118649web-vulnerabilityssrfexfiltration