Improper Neutralization of Special Elements in Data Query Logic in n8n - CVE-2026-118641
Published: October 14, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU155719
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118641
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose the bound mailbox's entire contact list.
The vulnerability exists due to improper neutralization of query syntax in the Microsoft Outlook node's contact lookup when constructing an OData $filter string literal from an expression-bound parameter. A remote user can supply a value containing a single quote that closes the literal and rewrites the query to disclose the bound mailbox's entire contact list.
Exploitation requires a workflow that binds untrusted input into the affected parameter. Access remains within the scope of the stored credential.
Affected software
n8n
How to mitigate CVE-2026-118641
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1