CVE-2026-126383
Deferred Deferred - Pending Action

NoSQL Injection in n8n Workflow Automation

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126383
EUVD
EUVD-2026-125182

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.89 (exc)
n8n n8n to 2.45.5 (exc)
n8n n8n to 2.46.1 (exc)
n8n n8n to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NoSQL injection vulnerability in n8n's MongoDB node affecting Update and Find And Replace operations. It occurs because the update key value from incoming items is not properly validated. Attackers can exploit this by sending untrusted input, such as webhook data, to manipulate the node into matching and overwriting unintended documents or inserting new ones in the MongoDB database.

Detection Guidance

To detect this vulnerability, check if your n8n instance is running a vulnerable version (before 1.123.89, 2.45.5, 2.46.1, or 3.0.1). Inspect workflows using the MongoDB node's Update or Find And Replace operations for untrusted input sources like webhooks. Monitor MongoDB logs for unexpected document modifications or insertions.

Impact Analysis

This vulnerability allows attackers to modify or delete unintended data in your MongoDB database, potentially leading to data corruption, unauthorized access, or loss of data integrity. If exploited, it could disrupt workflows relying on accurate data and compromise subsequent systems that depend on this data.

Compliance Impact

This vulnerability could lead to unauthorized data modifications or deletions, violating integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be impacted if sensitive data is altered or exposed without authorization, potentially resulting in legal penalties or loss of trust.

Mitigation Strategies

Upgrade n8n to the latest patched version (1.123.89, 2.45.5, 2.46.1, or 3.0.1+). If immediate upgrade isn't possible, restrict access to trusted users, audit MongoDB node usage, disable the MongoDB node if unused, or deactivate affected workflows until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...