Live › vulnerability › CVE-2026-118645
Go to dashboardn8n's Quick Base node sends the Where filter to the Quick Base API as raw query text, so untrusted input such as webhook data can alter the filter. An attacker can make Get Many return every record or Delete remove every record, using the workflow credential's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Teams running self-hosted or cloud n8n on an affected version whose workflows use the Quick Base node and pass untrusted data, such as webhook payloads, into the Where filter. Workflows that do not use Quick Base, or that only use fixed values for the filter, are not exposed by this flaw.
No product ranges from the sources yet.
n8n --version and compare it to the fixed releases in the fix section.1.123.85 on the 1.x line, 2.43.5 on the 2.x line, or 2.44.1 on the 2.44.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential's privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-118645")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.