CVE-2026-85167
n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.
| CWE | CWE-943 |
| Vendor | n8n-io |
| Product | n8n |
| Published | Sep 3, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n-io n8n
Be the first to know when new unknown vulnerabilities affecting n8n-io n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n8n-io / n8n
0 < 2.36.2
n8n-io / n8n
0 < 2.35.4