---
id: "CVE-2026-126383"
page: "https://infrastack.ai/live/CVE-2026-126383"
kind: "vulnerability"
aliases: ["CVE-2026-126383"]
title: "n8n: MongoDB node lets crafted input overwrite unintended documents"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "mongodb", "n8n", "self-hosted", "webhooks"]
not_affected_if: ["no-mongodb-node", "no-untrusted-input", "patched-version"]
published_at: "2026-11-13T10:17:41+00:00"
first_seen_at: "2026-11-13T10:47:18+00:00"
updated_at: "2026-11-13T10:52:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126383", "first_seen_at": "2026-11-13T10:47:18+00:00"}]
exploit_sources: []
---

# n8n: MongoDB node lets crafted input overwrite unintended documents

Link for people: https://infrastack.ai/live/CVE-2026-126383 (this .md is for agents)

n8n's MongoDB node does not validate the update key taken from incoming workflow items, enabling a NoSQL injection in its Update and Find And Replace operations. An attacker who can supply input such as a webhook body can make the node match and overwrite unintended documents or insert new ones.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the n8n version with `n8n --version` against the fixed ranges.
- Look for workflows that use the MongoDB node's Update or Find And Replace operations and take input from webhooks or other untrusted sources.

## Fix

- n8n `1.123.89` or later on the 1.x line
- n8n `2.45.5` or later on the 2.x line
- n8n `2.46.1` or later on the 2.46.x line
- n8n `3.0.1` or later on the 3.x line

## Timeline

- 2026-11-13T10:47:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126383

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/n8n-before-1.123.89-nosql-injection-via-mongodb-node-update-key

## From the sources

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_