---
id: "CVE-2026-118641"
kind: "vulnerability"
aliases: ["CVE-2026-118641"]
title: "n8n: OData filter injection in Outlook and SharePoint nodes exposes contacts"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "microsoft-outlook", "n8n", "self-hosted", "sharepoint", "workflow-automation"]
not_affected_if: ["no-outlook-or-sharepoint-nodes", "patched-version", "static-parameters"]
published_at: "2026-10-28T19:17:31+00:00"
first_seen_at: "2026-10-28T19:34:55+00:00"
updated_at: "2026-10-28T19:36:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118641", "first_seen_at": "2026-10-28T19:34:55+00:00"}]
---

# n8n: OData filter injection in Outlook and SharePoint nodes exposes contacts

n8n builds OData $filter strings from workflow parameters without escaping in the Microsoft Outlook contact lookup and SharePoint v1 item update nodes. An attacker who controls input to those workflows can inject single quotes to read the whole contact list of the mailbox or redirect SharePoint writes to unintended list items within the stored credential's scope.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the n8n version with `n8n --version` or the Docker image tag; affected builds are below `1.123.85`, below `2.43.5`, and `2.44.x` below `2.44.1`.
- Look for workflows that use the Microsoft Outlook contact lookup or the Microsoft SharePoint v1 item update nodes with expression-bound parameters fed from untrusted input.

## Fix

- Upgrade n8n to `1.123.85`, `2.43.5`, or `2.44.1` depending on the release line in use.
- Until upgraded, remove untrusted expression input from Outlook contact lookup and SharePoint item update parameters and rotate the Microsoft credentials used by those nodes if exposure is suspected.

## Timeline

- 2026-10-28T19:34:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118641

## From the sources

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_