AI Threat AlertCVE-2026-118641: n8n: OData filter injection in Outlook/SharePoint nodes
HIGHn8n, the workflow automation platform widely used to wire AI agents to business systems, has an OData $filter injection flaw in its Microsoft Outlook contact lookup and SharePoint v1 item update nodes. Workflows that pass untrusted input (webhook payloads, form fields, or LLM-generated values) into these nodes let an attacker inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes to unintended list items within the stored credential's scope. The CVSS is 7.5 (high) with high attack complexity because exploitation depends on a workflow wiring untrusted input into these specific nodes; there is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so the likelihood of mass exploitation is currently low but the confidentiality impact is real, and the scope change means the stored Microsoft credential's reach is what matters. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, and until then review workflows that feed external or agent-supplied data into the Outlook contact and SharePoint v1 nodes.
What is the risk?
Medium-high. CVSS 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N). Exploitation needs a workflow that exposes an expression-bindable parameter to attacker-controlled input, which raises complexity, but no authentication or user interaction is required once such a workflow exists. Scope change means impact extends to the Microsoft 365 data reachable with the stored credential. Not in CISA KEV, no known public exploit, no Nuclei template, EPSS and SSVC unavailable. Exposure is highest for internet-facing webhook or form-triggered workflows and for AI agent workflows where an LLM supplies the filter value.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Inventory workflows that use the Microsoft Outlook (contact lookup) and Microsoft SharePoint v1 (update item) nodes and identify any whose filter parameters are bound to expressions fed by webhooks, forms, chat triggers or LLM output. 3) As a workaround, validate or sanitize inputs before these nodes (reject or escape single quotes, allow-list expected formats) and avoid passing agent-generated free text into filter parameters. 4) Apply least privilege to the Microsoft OAuth credentials (scope them to the minimum mailbox and SharePoint sites/lists). 5) Detect: review Microsoft 365 audit logs and n8n execution logs for unusually broad contact reads or SharePoint item updates against unexpected list items, and for inputs containing quote characters in affected workflows. 6) Restrict exposure of webhook and form triggers with authentication or network controls.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-118641?
n8n, the workflow automation platform widely used to wire AI agents to business systems, has an OData $filter injection flaw in its Microsoft Outlook contact lookup and SharePoint v1 item update nodes. Workflows that pass untrusted input (webhook payloads, form fields, or LLM-generated values) into these nodes let an attacker inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes to unintended list items within the stored credential's scope. The CVSS is 7.5 (high) with high attack complexity because exploitation depends on a workflow wiring untrusted input into these specific nodes; there is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so the likelihood of mass exploitation is currently low but the confidentiality impact is real, and the scope change means the stored Microsoft credential's reach is what matters. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, and until then review workflows that feed external or agent-supplied data into the Outlook contact and SharePoint v1 nodes.
Is CVE-2026-118641 actively exploited?
No confirmed active exploitation of CVE-2026-118641 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-118641?
1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Inventory workflows that use the Microsoft Outlook (contact lookup) and Microsoft SharePoint v1 (update item) nodes and identify any whose filter parameters are bound to expressions fed by webhooks, forms, chat triggers or LLM output. 3) As a workaround, validate or sanitize inputs before these nodes (reject or escape single quotes, allow-list expected formats) and avoid passing agent-generated free text into filter parameters. 4) Apply least privilege to the Microsoft OAuth credentials (scope them to the minimum mailbox and SharePoint sites/lists). 5) Detect: review Microsoft 365 audit logs and n8n execution logs for unusually broad contact reads or SharePoint item updates against unexpected list items, and for inputs containing quote characters in affected workflows. 6) Restrict exposure of webhook and form triggers with authentication or network controls.
What systems are affected by CVE-2026-118641?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, RAG pipelines, SaaS integration connectors.
What is the CVSS score for CVE-2026-118641?
CVE-2026-118641 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.30%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0036Data from Information RepositoriesAML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.
Exploitation Scenario
An organization runs an n8n workflow that receives a customer request via a public webhook, uses an AI agent to extract a contact name, and passes it into the Outlook contact lookup node's $filter. The attacker submits a name such as ' or 1 eq 1 or displayName eq ' so that the injected quote breaks out of the string literal and the filter matches every contact. The workflow returns, or an agent relays, the entire contact list of the connected mailbox, which the attacker harvests for targeted phishing. In a second variant, an injected SharePoint filter makes the update node write to a different list item than intended, tampering with records that other automations or AI knowledge bases consume.
Weaknesses (CWE)
CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimaryCWE-943Improper Neutralization of Special Elements in Data Query LogicCWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n