---
id: CVE-2026-118641
title: >-
  n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook
  and SharePoint Nodes
summary: >-
  n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an
  OData $filter injection vulnerability in the Microsoft Outlook contact lookup
  and Microsoft SharePoint v1 item update nodes, which build $filter string
  literals…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-943
vendor: n8n-io
product: n8n
affected:
  - n8n < 1.123.85
  - n8n >= 2.44.0 < 2.44.1
  - n8n >= 2.0.0 < 2.43.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T15:28:36.441528Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T20:54:49.193Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118641'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-mgpr-56r4-5c67'
    label: GitHub Security Advisory (GHSA-mgpr-56r4-5c67)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-odata-filter-injection-via-outlook-and-sharepoint-nodes
    label: >-
      VulnCheck Advisory: n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter
      Injection via Outlook and SharePoint Nodes
tags:
  - cve.org
epss: 0.00296
epssPercentile: 0.22311
ingestedAt: '2026-10-29T15:37:07.526Z'
---

## Overview

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.

## Affected

- `n8n < 1.123.85`
- `n8n >= 2.44.0 < 2.44.1`
- `n8n >= 2.0.0 < 2.43.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.