AI Threat AlertCVE-2026-126383: n8n: NoSQL injection in MongoDB node overwrites data
HIGHA NoSQL injection flaw in n8n's MongoDB node (Update and Find And Replace operations) lets an attacker who controls workflow input, such as a webhook body, make the node match and overwrite unintended documents or insert new ones. The CVSS score is 8.2 (high) with network reach and no user interaction, but high attack complexity and a required low-privilege foothold limit casual exploitation. No EPSS score, public exploit, Nuclei template or CISA KEV listing exists today, so there is no evidence of active exploitation, though the VulnCheck and GitHub advisories make the flaw publicly known. The real exposure is integrity: n8n is widely used to wire AI agents to databases, so tampered records can poison data that downstream agents and RAG flows trust. Upgrade to 1.123.89, 2.45.5, 2.46.1 or 3.0.1 or later, and until then audit workflows that pass webhook or other untrusted data into MongoDB update keys.
What is the risk?
High severity (CVSS 8.2) with integrity and availability impact and a changed scope. Exploitation needs untrusted input to reach the update key of a MongoDB node, and the high attack complexity and low privilege requirement reduce likelihood. No EPSS data, public exploit, Nuclei template or KEV listing is available, so the near-term probability of exploitation is unknown but likely low to moderate. Exposure is greatest for internet-facing webhook workflows that feed MongoDB operations. Package risk data is limited (0/100, no dependents data).
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 1.123.89, 2.45.5, 2.46.1, 3.0.1 or later. 2) Until patched, find workflows that use the MongoDB node's Update or Find And Replace operations with an update key derived from webhook bodies or other external input, and hard-code or strictly validate that key (allow-list, type-check as a string, reject objects and operators such as $ne or $gt). 3) Restrict webhook exposure with authentication, IP allow-lists or a reverse proxy. 4) Give the MongoDB credential used by n8n least-privilege, collection-scoped write access. 5) Detect by reviewing MongoDB audit or oplog entries for unexpected updates, inserts or upserts from the n8n service account, and by inspecting n8n execution logs for webhook payloads containing operator characters such as $ or nested objects. 6) Keep backups or point-in-time recovery for affected collections.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126383?
A NoSQL injection flaw in n8n's MongoDB node (Update and Find And Replace operations) lets an attacker who controls workflow input, such as a webhook body, make the node match and overwrite unintended documents or insert new ones. The CVSS score is 8.2 (high) with network reach and no user interaction, but high attack complexity and a required low-privilege foothold limit casual exploitation. No EPSS score, public exploit, Nuclei template or CISA KEV listing exists today, so there is no evidence of active exploitation, though the VulnCheck and GitHub advisories make the flaw publicly known. The real exposure is integrity: n8n is widely used to wire AI agents to databases, so tampered records can poison data that downstream agents and RAG flows trust. Upgrade to 1.123.89, 2.45.5, 2.46.1 or 3.0.1 or later, and until then audit workflows that pass webhook or other untrusted data into MongoDB update keys.
Is CVE-2026-126383 actively exploited?
No confirmed active exploitation of CVE-2026-126383 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126383?
1) Upgrade n8n to 1.123.89, 2.45.5, 2.46.1, 3.0.1 or later. 2) Until patched, find workflows that use the MongoDB node's Update or Find And Replace operations with an update key derived from webhook bodies or other external input, and hard-code or strictly validate that key (allow-list, type-check as a string, reject objects and operators such as $ne or $gt). 3) Restrict webhook exposure with authentication, IP allow-lists or a reverse proxy. 4) Give the MongoDB credential used by n8n least-privilege, collection-scoped write access. 5) Detect by reviewing MongoDB audit or oplog entries for unexpected updates, inserts or upserts from the n8n service account, and by inspecting n8n execution logs for webhook payloads containing operator characters such as $ or nested objects. 6) Keep backups or point-in-time recovery for affected collections.
What systems are affected by CVE-2026-126383?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, RAG pipelines, agent memory stores, data ingestion pipelines.
What is the CVSS score for CVE-2026-126383?
CVE-2026-126383 has a CVSS v3.1 base score of 8.2 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049Exploit Public-Facing ApplicationAML.T0059Erode Dataset IntegrityAML.T0099AI Agent Tool Data PoisoningCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database.
Exploitation Scenario
An organization runs an n8n workflow with a public webhook that ingests support-ticket updates and writes them to MongoDB, where an AI agent reads them as context. The attacker sends a webhook body whose update key is a MongoDB query object instead of a plain identifier. The Update node matches many or unintended documents and overwrites them with attacker-chosen content, or inserts new documents. The AI agent later retrieves the tampered records, acting on false data, producing wrong outputs, or losing access to legitimate records.
Weaknesses (CWE)
CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimaryCWE-943Improper Neutralization of Special Elements in Data Query LogicCWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n