CVE-2026-118641

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.85 n8n versions prior to 2.43.5 n8n versions prior to 2.44.1

Description An OData $filter injection issue exists in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes. These nodes construct $filter string literals from expression-bindable parameters without proper escaping. This allows attackers providing untrusted input to inject single quotes, potentially enabling them to dump the entire contact list of the bound mailbox or redirect SharePoint writes to unintended list items within the scope of the stored credentials.

Recommendations Update n8n to version 1.123.85 or later. Update n8n to version 2.43.5 or later. Update n8n to version 2.44.1 or later.