NoSQL Injection in n8n Workflow Automation Platform

Executive Summary

CVE-2026-77070 is a NoSQL injection vulnerability in n8n versions before 1.123.69, 2.33.4, and 2.34.1. It affects the MongoDB node's Find, Delete, and Aggregate operations where the Query parameter is parsed as JSON after expression resolution without sanitizing MongoDB operators like $ne or $where. Attackers can inject these operators to manipulate queries, enabling unauthorized data disclosure, deletion, or other database operations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor n8n logs for suspicious MongoDB queries containing NoSQL operators like $ne, $where, or $regex. Check for unexpected database operations such as full-collection scans or deletions. Review workflows using the MongoDB node for externally controlled input sources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access, modify, or delete data in the MongoDB database without authorization. If you use affected n8n versions, an attacker could exploit this to extract sensitive information, delete critical data, or perform other malicious actions on your database, potentially leading to data breaches or service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. A breach could result in legal penalties, loss of trust, and reputational damage due to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade n8n to versions 1.123.69, 2.33.4, or 2.34.1 or later. If upgrading is not possible, restrict access to the MongoDB node, audit all workflows using it, and disable the node if not required. Implement input validation for all query parameters.

Useful 0 Not Useful 0