n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
n8n
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- Record
- CVE-2026-54313
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 25, 2026
Description
n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool that connects different apps and services so routine tasks run automatically. It affects versions before 2.24.0. The problem is in the building block that lets a workflow work with a MongoDB database, specifically its Find And Replace action. Someone who can log in to n8n and has permission to edit workflows could enter a crafted search value that is not checked properly. That could let them match database records that were never meant to be changed and overwrite those records with content of their choosing. This flaw is rated High.
What to do
- Find out who runs n8n for your organization: the person who installed it, or the IT provider or vendor that manages it for you. That person should act on this advisory.
- Have them check which version of n8n is running. Any version before
2.24.0has this flaw. - Update n8n to version
2.24.0or later, which fixes this flaw. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.