CVE-2026-85167: n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.
Affected Software
Event History
Frequently Asked Questions
Which n8n operations are affected?
The affected operations are Elasticsearch Document Get All and Google Cloud Firestore Document Query. The issue arises when these operations construct JSON queries by directly interpolating expression values before parsing.
What does an attacker need to exploit this issue?
An attacker needs control over an expression value used in an affected query. A value containing quote and brace characters can terminate the intended field and add query operators.
What is the potential impact of successful exploitation?
Successful injection can change an intended single-document lookup into a full-collection read, exposing data beyond the document that the workflow was expected to retrieve.
Which versions should be remediated?
Affected versions are n8n before 2.35.4 and versions in the 2.36.x line before 2.36.2. Upgrading to 2.35.4 or 2.36.2, as applicable to the deployment branch, addresses the listed affected ranges.