CVE-2026-85167
Received Received - Intake

Elasticsearch Query Injection in n8n

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85167
EUVD
EUVD-2026-70402

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n From 2.36.0 (inc) to 2.36.2 (exc)
n8n n8n to 2.36.2 (exc)
n8n n8n to 2.35.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a query injection vulnerability in n8n versions before 2.36.2 and 2.35.4 affecting Elasticsearch Document Get All and Google Cloud Firestore Document Query operations. It occurs when expression values with quote and brace characters are directly inserted into query strings without proper escaping. Attackers can manipulate queries to turn a single-document lookup into a full-collection read by closing the intended field and adding new query operators.

Detection Guidance

To detect this vulnerability, check the version of n8n installed on your system. Run commands like 'n8n --version' or check the package.json file in your n8n installation directory. If the version is below 2.35.4 or 2.36.2, the system is vulnerable.

Impact Analysis

An attacker could exploit this to read more data than intended from Elasticsearch or Firestore, potentially exposing sensitive information. The impact is limited to confidentiality breaches in connected systems since the vulnerability does not directly affect the n8n system itself. Exploitation requires low privileges and no user interaction.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected n8n versions may face compliance violations if sensitive data is exposed through query manipulation.

Mitigation Strategies

Immediately update n8n to version 2.35.4, 2.36.2, or later. If updating is not possible, disable the Elasticsearch Document Get All and Google Cloud Firestore Document Query nodes in affected workflows. Restrict access to trusted users and audit workflows for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart