CVE-2026-118641 Details

An OData $filter injection vulnerability has been identified in n8n versions prior to 1.123.85, 2.43.5 prior to 2.44.1, and 2.44.x prior to 2.44.1. This vulnerability exists in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes. The issue arises because these nodes construct $filter string literals from expression-bindable parameters without proper escaping. As a result, attackers can inject single quotes to manipulate the query. In the case of the Outlook node, this could lead to the exposure of the entire contact list from the bound mailbox instead of a single contact. For the SharePoint node, the injection could redirect writes to unintended list items, all within the scope of the stored credentials.

Users are advised to upgrade to n8n versions 1.123.85, 2.44.1, or 2.43.5. If an immediate upgrade is not possible, consider restricting access to the n8n instance, auditing workflows that use the affected Outlook or SharePoint operations, applying network-level controls to restrict access to relevant webhook endpoints, or deactivating the affected workflows until the instance can be patched.