CVE-2026-85167 in n8n
Summary
by MITRE • 09/03/2026
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in n8n versions prior to 2.35.4 and version 2.36.x prior to 2.36.2 represents a critical injection flaw within the data retrieval operations for Elasticsearch Document Get All and Google Cloud Firestore Document Query nodes. This security issue stems from an improper neutralization of special elements used in queries, commonly categorized under CWE-77 as Command Injection or more specifically CWE-94 SQL Injection when applied to query languages. The core technical defect lies in how these workflow automation components construct their underlying database queries. Instead of utilizing parameterized queries or safe serialization methods that strictly separate code from data, the application interpolates user-supplied expression values directly into the JSON query string before parsing occurs. This architectural choice creates a vector where malicious input can alter the structure and intent of the executed command.
In operational terms, this flaw allows an attacker who controls the input expressions to manipulate the database interaction logic. By injecting specific characters such as quotes and braces, which are syntactically significant in JSON structures, the attacker can close the intended field definition prematurely. This closure effectively terminates the original query constraint designed for a single-document lookup or targeted filter. Following this termination, the injected payload introduces new query operators that were not part of the original workflow design. Consequently, what was intended to be a restricted read operation on a specific document is transformed into an unrestricted full-collection read. This escalation in privilege allows access to data that should remain isolated from the current context or user role.
The impact of this vulnerability extends beyond simple data exposure. In environments where n8n orchestrates sensitive workflows, such as financial processing or healthcare data management, unauthorized bulk reads can lead to significant confidentiality breaches. Attackers could exfiltrate large volumes of structured data by exploiting these injection points across multiple workflow executions. Furthermore, depending on the specific configuration and permissions granted to the service accounts associated with Elasticsearch or Google Cloud Firestore, this vulnerability might serve as a stepping stone for further exploitation, including potential write operations if similar patterns exist elsewhere in the application logic. The lack of input validation at the query construction stage means that even complex filtering rules can be bypassed entirely through clever payload formulation.
Mitigation strategies must prioritize immediate version upgrades to n8n 2.35.4 or later for the stable branch, and 2.36.2 or later for the development branch, as these releases address the underlying interpolation logic flaws. Until an upgrade is feasible, administrators should implement strict input validation at the workflow level, ensuring that expression values are sanitized to remove special characters like quotes and braces before they reach the database nodes. Additionally, applying principle of least privilege to the service accounts used by n8n can limit the damage scope; restricting these accounts to read-only access on specific collections or indices reduces the risk associated with full-collection reads. Monitoring logs for anomalous query patterns that deviate from expected single-document lookups may also aid in early detection of exploitation attempts. This vulnerability aligns with MITRE ATT&CK technique T1059, specifically Command Scripting, as it involves manipulating system commands to achieve unauthorized data access.