Input validation error in n8n - CVE-2026-126383
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU163074
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126383
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker with low privileges to overwrite unintended MongoDB documents or insert new documents.
The vulnerability exists due to insufficient validation of incoming update key values in the n8n MongoDB node's Update and Find And Replace operations when a workflow passes untrusted input. A remote authenticated attacker with low privileges can submit crafted input through such a workflow to make database operations target documents outside the intended match.
Affected software
n8n
How to mitigate CVE-2026-126383
Install security update from vendor's website.
n8n - addressed in versions 1.123.89, 2.45.5, 2.46.1, 3.0.1