EUVD-2026-63259
GHSA-4x9q-xqfh-jh4j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires specific workflow configuration routing external input to MongoDB node (AC:H, matching AT:P); scope change because MongoDB is the impacted component, not n8n itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query (e.g., via externally-controlled data) can inject operators such as $ne or $where, turning an intended single-document lookup into full-collection disclosure, full-collection deletion, or other operations on the database server.
AnalysisAI
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: first, the target n8n instance must use the MongoDB integration node in a workflow with Find, Delete, or Aggregate operations; second, the workflow must accept externally-controlled data - such as webhook payloads, HTTP parameters, or form submissions - and route that data into the MongoDB node's Query parameter without sanitization or strict type enforcement; third, the MongoDB database must be reachable from the n8n server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H) rates the subsequent-system (MongoDB database) impact as High across all three pillars, while the vulnerable system (n8n itself) shows no direct impact - correctly reflecting that n8n is the injection point but MongoDB bears the operational consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an n8n instance with a publicly accessible webhook-triggered workflow that performs a MongoDB Find operation using a customer-supplied identifier (e.g., a product ID or user lookup). By sending a crafted webhook payload where the query field contains {"$ne": null} instead of a legitimate value, the attacker transforms the intended single-record lookup into a full-collection scan, retrieving all documents. … |
| Remediation | The primary fix is to upgrade n8n to version 1.123.69 or later for v1 deployments, or to 2.33.4 / 2.34.1 or later for v2 deployments, as documented in GHSA-953p-jm2c-8h5j. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all n8n deployments across infrastructure, document which use MongoDB integration nodes (Find, Delete, Aggregate operations), and identify affected versions (1.123.68 and earlier for v1; 2.33.3 and earlier for v2) and which workflows accept external input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today