---
id: "GHSA-4v22-g448-h4rg"
page: "https://infrastack.ai/live/GHSA-4v22-g448-h4rg"
kind: "vulnerability"
aliases: ["GHSA-4v22-g448-h4rg"]
title: "MongoDB Node Update Operations Can Modify Unintended Documents"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "n8n", "fixed": [">= 1.123.89"], "affected": "< 1.123.89", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.46.1"], "affected": "< 2.46.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.45.5"], "affected": "< 2.45.5", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 3.0.1"], "affected": "< 3.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["mongodb", "n8n", "package", "self-hosted", "webhooks"]
not_affected_if: ["hardcoded-update-key", "managed-hosting", "no-mongodb-node", "read-only-workflows"]
published_at: "2026-10-28T08:48:23+00:00"
first_seen_at: "2026-11-09T22:53:25+00:00"
updated_at: "2026-11-09T22:56:40+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg", "first_seen_at": "2026-11-09T22:53:25+00:00"}]
exploit_sources: []
---

# MongoDB Node Update Operations Can Modify Unintended Documents

Link for people: https://infrastack.ai/live/GHSA-4v22-g448-h4rg (this .md is for agents)

The MongoDB node in n8n did not validate the update key taken from incoming workflow data. A caller who controls that input, for example through a webhook, can make an Update or Find And Replace match and overwrite other documents or insert new ones.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 1.123.89 fixed >= 1.123.89
- npm:n8n affected < 2.46.1 fixed >= 2.46.1
- npm:n8n affected < 2.45.5 fixed >= 2.45.5
- npm:n8n affected < 3.0.1 fixed >= 3.0.1

## How to check

- Run `npm ls n8n` or check the n8n version in the running instance
- Find workflows that use the MongoDB node with Update or Find And Replace and confirm whether `updateKey` can be set from a webhook body or other untrusted input
- Check whether `NODES_EXCLUDE` includes `n8n-nodes-base.mongoDb`

## Fix

- n8n `1.123.89`
- n8n `2.45.5`
- n8n `2.46.1`
- n8n `3.0.1`

## Timeline

- 2026-11-09T22:53:25+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg

## From the sources

## Impact

In the MongoDB node's Update and Find And Replace operations, the update key value taken from the incoming item was not sufficiently validated. Where a workflow passes untrusted input, such as a webhook body, to one of these operations, a caller could make the node match and overwrite documents other than the one the workflow intended, or insert new documents.

## Patches

The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit active workflows that use the MongoDB node with Find And Replace or Update operations and ensure the `updateKey` value cannot be influenced by untrusted external data.
- Apply network-level controls to restrict access to webhook endpoints that feed into MongoDB update workflows.
- Disable the MongoDB node by adding `n8n-nodes-base.mongoDb` to the `NODES_EXCLUDE` environment variable if it is not required.
- Deactivate affected workflows until the instance is patched.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_