CVE-2026-126383: n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.89 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.45.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.46.1 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Which workflows are exposed to this issue?
Workflows that use the MongoDB node's Update or Find And Replace operation and derive the update key value from untrusted incoming items are exposed. A webhook body is one example of an untrusted input source.
What level of access does an attacker need?
An attacker must be able to supply input that reaches the update key value used by an affected MongoDB node operation. The issue does not require user interaction, but exploitation has high attack complexity and requires low privileges.
What can an attacker do through a vulnerable workflow?
They can cause the MongoDB node to match and overwrite unintended documents or insert new documents in the database. The reported impact affects integrity and availability, with no stated confidentiality impact.
Which versions need remediation?
Affected versions are n8n releases before 1.123.89, 2.x releases before 2.45.5, 2.46.x releases before 2.46.1, and 3.x releases before 3.0.1. Upgrade to the applicable fixed version or later.
What can be done if upgrading is not immediately possible?
Prevent untrusted incoming values from being used as the MongoDB Update or Find And Replace update key. Review workflows that accept webhook or other external input and use a fixed or validated update key instead.