Live › vulnerability › CVE-2026-118641
Go to dashboardn8n builds OData $filter strings from workflow parameters without escaping in the Microsoft Outlook contact lookup and SharePoint v1 item update nodes. An attacker who controls input to those workflows can inject single quotes to read the whole contact list of the mailbox or redirect SharePoint writes to unintended list items within the stored credential's scope.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Teams that self-host or use n8n with Microsoft Outlook or SharePoint nodes whose parameters are filled from data an outsider can influence, such as form submissions, webhooks, or inbound emails. Workflows that only use these nodes with fixed, internally controlled values have a much smaller exposure, and instances on the patched versions are not affected.
No product ranges from the sources yet.
n8n --version or the Docker image tag; affected builds are below 1.123.85, below 2.43.5, and 2.44.x below 2.44.1.1.123.85, 2.43.5, or 2.44.1 depending on the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.
This page as .md · .json · in your agent: get_signal("CVE-2026-118641")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.