N8N · GHSA-4v22-g448-h4rg · Package
FIX → >= 1.123.89 +3
The MongoDB node in n8n did not validate the update key taken from incoming workflow data. A caller who controls that input, for example through a webhook, can make an Update or Find And Replace match and overwrite other documents or insert new ones.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure requires a workflow that runs the MongoDB node's Update or Find And Replace operation and takes its updateKey value from untrusted input such as a webhook body. Workflows that only read from MongoDB, or that hard-code the update key, are not exposed by this flaw. Teams running n8n with only trusted users and no untrusted input feeding those operations have lower practical risk.
Not affected if hardcoded-update-key, managed-hosting, no-mongodb-node, read-only-workflows
Who cares mongodb, n8n, self-hosted, webhooks
npm ls n8n or check the n8n version in the running instanceupdateKey can be set from a webhook body or other untrusted inputIn the MongoDB node's Update and Find And Replace operations, the update key value taken from the incoming item was not sufficiently validated. Where a workflow passes untrusted input, such as a webhook body, to one of these operations, a caller could make the node match and overwrite documents other than the one the workflow intended, or insert new documents.
The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
updateKey value cannot be influenced by untrusted external data.n8n-nodes-base.mongoDb to the NODES_EXCLUDE environment variable if it is not required.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NODES_EXCLUDE includes n8n-nodes-base.mongoDbUpgrade to >= 1.123.89 +3
1.123.892.45.52.46.13.0.1