CVE-2026-118645: n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential's privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.85
Event History
Frequently Asked Questions
Which workflows are exposed to this issue?
Workflows that use the Quick Base node and construct its Where filter from untrusted input, such as webhook data, are exposed. The impact is limited by the privileges of the Quick Base credential configured for that workflow.
What can an unauthenticated attacker do?
An attacker who can supply input used to build the Where filter can inject raw query text. This can cause Get Many to return every record or cause Delete to remove every record accessible through the workflow credential.
Which versions need to be updated?
Update to 1.123.85 or later for the 1.x line, 2.43.5 or later for the 2.x line before 2.44, or 2.44.1 or later for the 2.44.x line.
What should be done if an update cannot be applied immediately?
Avoid using untrusted input to construct the Quick Base node's Where filter. Review affected workflows and restrict the associated Quick Base credential to the minimum required permissions, particularly avoiding broad delete access.