CVE-2026-118645: n8n Quick Base node filter injection

CISO Take

n8n's Quick Base node passes the Where filter to the Quick Base API as raw query text. Any workflow that builds that filter from untrusted input, such as webhook data, lets an attacker make Get Many return every record or Delete wipe every record, using the workflow credential's privileges. The CVSS of 8.7 reflects scope change and high confidentiality and integrity impact. The high attack complexity reflects that exploitation depends on a workflow that wires external input into the filter. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so near-term mass exploitation looks unlikely. n8n is widely used to orchestrate AI agents and automations, so the data and credentials behind affected workflows deserve attention. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, and review workflows that feed webhook or form input into Quick Base node filters.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium-high. The CVSS is 8.7 (network, no privileges, no user interaction, changed scope), but the high attack complexity lowers practical likelihood because the attacker needs a workflow that routes untrusted input into the Where filter. There is no KEV entry, public exploit or scanner template, and EPSS is not available. Impact is high for confidentiality and integrity: bulk record disclosure and bulk deletion, using the workflow credential's privileges. Availability is not rated in the CVSS vector, but mass deletion has operational effects. Exposure is highest on internet-facing n8n webhook triggers connected to Quick Base.

How does the attack unfold?

Initial Access

The attacker sends crafted input to a public n8n webhook or form whose value flows into the Quick Base Where filter.

AML.T0049

Exploitation

The injected filter syntax is passed as raw query text to the Quick Base API and changes the query logic.

AML.T0053

Impact

Get Many returns every record, or Delete removes every record, using the workflow credential's privileges.

AML.T0101

Initial Access

The attacker sends crafted input to a public n8n webhook or form whose value flows into the Quick Base Where filter.

AML.T0049

Exploitation

The injected filter syntax is passed as raw query text to the Quick Base API and changes the query logic.

AML.T0053

Impact

Get Many returns every record, or Delete removes every record, using the workflow credential's privileges.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

8.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, avoid building the Quick Base Where filter from untrusted input; validate or whitelist values and strip filter syntax characters. 3) Disable or restrict workflows that expose webhooks feeding the Quick Base node. 4) Scope the Quick Base credential to least privilege, ideally read-only where deletes are not needed, and limit it to the required tables. 5) Make sure Quick Base backups exist so mass deletion can be reversed. 6) Detect: review webhook and n8n execution logs for unusual filter syntax in inputs, and monitor Quick Base audit logs for large Get Many reads or bulk deletes.

How is it classified?

Data LeakageData ExtractionFrameworkAgentPluginAML.T0049- Exploit Public-Facing Application AML.T0085.001- AI Agent Tools AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and mechanisms to supersede or deactivate systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118645?

n8n's Quick Base node passes the Where filter to the Quick Base API as raw query text. Any workflow that builds that filter from untrusted input, such as webhook data, lets an attacker make Get Many return every record or Delete wipe every record, using the workflow credential's privileges. The CVSS of 8.7 reflects scope change and high confidentiality and integrity impact. The high attack complexity reflects that exploitation depends on a workflow that wires external input into the filter. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so near-term mass exploitation looks unlikely. n8n is widely used to orchestrate AI agents and automations, so the data and credentials behind affected workflows deserve attention. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, and review workflows that feed webhook or form input into Quick Base node filters.

Is CVE-2026-118645 actively exploited?

No confirmed active exploitation of CVE-2026-118645 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118645?

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, avoid building the Quick Base Where filter from untrusted input; validate or whitelist values and strip filter syntax characters. 3) Disable or restrict workflows that expose webhooks feeding the Quick Base node. 4) Scope the Quick Base credential to least privilege, ideally read-only where deletes are not needed, and limit it to the required tables. 5) Make sure Quick Base backups exist so mass deletion can be reversed. 6) Detect: review webhook and n8n execution logs for unusual filter syntax in inputs, and monitor Quick Base audit logs for large Get Many reads or bulk deletes.

What systems are affected by CVE-2026-118645?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, webhook-triggered AI automations, RAG data sources.

What is the CVSS score for CVE-2026-118645?

CVE-2026-118645 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation pipelineswebhook-triggered AI automationsRAG data sources

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0085.001AI Agent Tools

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential's privileges.

Exploitation Scenario

An organization runs an n8n workflow with a public webhook that takes a customer ID and looks up the customer's records in Quick Base. An LLM agent or form feeds that value into the Where filter. The attacker sends a crafted value that adds an always-true clause to the filter, so Get Many returns every record and exposes data from all customers. With a delete workflow, the same injection makes the Delete operation remove every record. Because the workflow credential carries broad Quick Base privileges, the attacker reaches data well beyond what the original workflow was meant to touch.

Weaknesses (CWE)

CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query Logic

CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE corpus.