CVE-2026-126383

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.89 n8n versions prior to 2.45.5 n8n versions prior to 2.46.1 n8n versions prior to 3.0.1

Description Insufficient validation of the update key value taken from incoming items in the MongoDB node allows for NoSQL injection. This occurs during Update and Find And Replace operations. Attackers providing untrusted input, such as a webhook body, to a workflow using these operations can cause the node to match and overwrite unintended documents or insert new documents into the MongoDB database.

Recommendations Update to version 1.123.89 or later. Update to version 2.45.5 or later. Update to version 2.46.1 or later. Update to version 3.0.1 or later.