OData $filter Injection Vulnerability in n8n Affecting Microsoft Outlook and SharePoint Nodes

CVE-2026-118641

What is CVE-2026-118641?

The affected versions of n8n, specifically before 1.123.85, 2.43.5, and 2.44.1, contain a vulnerability that allows attackers to exploit OData $filter parameters utilized within Microsoft Outlook contact lookups and SharePoint item updates. This vulnerability arises due to the insufficient escaping of untrusted input in the construction of $filter string literals. Consequently, an attacker can potentially inject single quotes, facilitating access to the complete contact list of the associated mailbox or redirecting SharePoint updates to unintended items within the scope of the stored credentials.

References