CVE-2026-118645

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.85 n8n versions 2.x prior to 2.43.5 n8n versions 2.44.x prior to 2.44.1

Description The Quick Base node contains a filter injection flaw where the Where filter is transmitted to the Quick Base API as raw query text. An attacker providing untrusted input, such as data from a webhook used to construct the filter, can manipulate the request. This allows the attacker to force the Get Many operation to return all records or the Delete operation to remove all records, operating with the privileges of the workflow credentials.

Recommendations Update n8n to version 1.123.85 or later. Update n8n 2.x to version 2.43.5 or later. Update n8n 2.44.x to version 2.44.1 or later.