CVE-2026-85167

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.35.4 n8n versions 2.36.0 through 2.36.1

Description Query injection occurs in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations. The issue arises because JSON queries are constructed by interpolating expression values directly into the query string before parsing. An attacker can use quote and brace characters to close the intended field and introduce new query operators, allowing a single-document lookup to be transformed into a full-collection read.

Recommendations Update n8n to version 2.35.4 or later. Update n8n to version 2.36.2 or later.