Skip to main content

n8n CVE-2026-85167

| EUVDEUVD-2026-70402 MEDIUM
Improper Neutralization of Special Elements in Data Query Logic (CWE-943)
2026-09-03 VulnCheck GHSA-7mp8-q29w-rc68
Google Code Injection Elastic Nosql Injection N8n N8N Io
6.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

Low-privilege authenticated access required; scope change to downstream data stores; full-collection read gives high confidentiality, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Sep 03, 2026 - 13:01 EUVD
Analysis Generated
Sep 03, 2026 - 12:03 vuln.today

DescriptionCVE.org

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.

AnalysisAI

Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid n8n account with sufficient privileges to create or modify workflows (PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with SC:H/SI:N/SA:N reflects the key risk profile: network-accessible, low complexity, no user interaction, but gated behind low-privilege authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade n8n to 2.35.4 (in the 2.35.x stream) or 2.36.2 (in the 2.36.x stream) per the vendor security advisory GHSA-wxwj-8wv6-vpw2 at https://github.com/n8n-io/n8n/security/advisories/GHSA-wxwj-8wv6-vpw2. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in N8n

View all
CVE-2026-21877 CRITICAL POC
9.9 Jan 08

n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
CVE-2026-21858 CRITICAL POC
10.0 Jan 08

n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical

CVE-2026-1470 CRITICAL POC
9.9 Jan 27

n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
CVE-2026-33696 CRITICAL POC
9.4 Mar 25

A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
CVE-2026-33660 CRITICAL POC
9.4 Mar 25

An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit

CVE-2025-55526 CRITICAL POC
9.1 Aug 26

n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
CVE-2026-33665 HIGH POC
8.8 Mar 25

Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
CVE-2023-27563 HIGH POC
8.8 May 10

The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability

CVE-2026-33713 HIGH POC
8.7 Mar 25

SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute

CVE-2026-0863 HIGH POC
8.5 Jan 18

Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
CVE-2026-33663 HIGH POC
8.5 Mar 25

n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
CVE-2023-27564 HIGH POC
7.5 May 10

The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is

Same weakness CWE-943 – Improper Neutralization of Special Elements in Data Query Logic

View all
CVE-2026-32248 CRITICAL POC
9.8
CVE-2026-32247 HIGH POC
8.1
CVE-2026-44840 HIGH POC
7.5
CVE-2026-25591 MEDIUM POC
6.5
CVE-2026-40351 CRITICAL
9.8
CVE-2026-41274 CRITICAL
9.3
CVE-2017-12904 HIGH
8.8
CVE-2026-45689 CRITICAL
9.1

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-85167 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy