CVE-2026-85167

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.

CVSS 4.0

6.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-29)

CWE

CWE-943

Published

2026-09-03

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

Affected

• n8n:n8n

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-wxwj-8wv6-vpw2
• https://www.vulncheck.com/advisories/n8n-before-2.36.2-query-injection-via-elasticsearch-firestore-nodes

Check your stackJSON