Improper Neutralization of Special Elements in Data Query Logic in n8n - CVE-2026-118645
Published: October 14, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU155726
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118645
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read or delete all records in a Quick Base table.
The vulnerability exists due to improper neutralization of filter input in the Quick Base node when building Where filters from untrusted input and sending them as raw query text to the Quick Base API. A remote user can supply crafted input that changes the filter logic to read or delete all records in a Quick Base table.
The affected operations are Get Many and Delete, which execute with the privileges of the workflow's credential.
Affected software
n8n
How to mitigate CVE-2026-118645
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1