CVE-2026-118641: n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.85 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.43.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.44.1
Event History
Frequently Asked Questions
Which workflows are exposed to this issue?
Workflows using the Microsoft Outlook contact lookup node or the Microsoft SharePoint v1 item update node are exposed when expression-bindable parameters receive untrusted input. Other workflows are not identified in the available data.
What does an attacker need to exploit it?
An attacker needs a way to supply untrusted input to an affected workflow parameter. They can use injected single quotes in that input to alter the OData $filter query.
What could an attacker access or change?
For Outlook contact lookups, an attacker may dump the entire contact list of the mailbox bound to the stored credential. For SharePoint v1 item updates, they may redirect writes to unintended list items within the stored credential's scope.
Which versions should be updated?
Update to 1.123.85 or later for the 1.x line, 2.43.5 or later for affected 2.x versions, or 2.44.1 or later for the 2.44.x line.
What can be done if updating is not immediately possible?
Prevent untrusted input from reaching expression-bindable parameters in the affected Outlook and SharePoint nodes. Review the scope of stored Microsoft credentials, since exploitation is limited to the mailbox contacts or SharePoint items accessible through those credentials.