CVE-2026-126383 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
n8n's MongoDB node does not validate the update key taken from incoming workflow items, enabling a NoSQL injection in its Update and Find And Replace operations. An attacker who can supply input such as a webhook body can make the node match and overwrite unintended documents or insert new ones.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted or cloud n8n workflows that use the MongoDB node's Update or Find And Replace operations with data from untrusted input such as webhook bodies. Workflows that do not use those operations, or that do not feed untrusted input into them, are not exposed by this flaw.
Not affected if no-mongodb-node, no-untrusted-input, patched-version
Who cares mongodb, n8n, self-hosted, webhooks
n8n --version against the fixed ranges.1.123.89 or later on the 1.x line2.45.5 or later on the 2.x line2.46.1 or later on the 2.46.x line3.0.1 or later on the 3.x linen8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.