CVE-2026-54313: n8n MongoDB Node Input Validation Flaw Allows Data Overwrite

Technical summary

CVE-2026-54313 is an input validation vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command, applying to MongoDB query languages) affecting n8n's MongoDB integration. The Find And Replace operation in the MongoDB node fails to validate or sanitize filter parameters before passing them to MongoDB's query engine. An authenticated user with workflow edit permissions can supply maliciously crafted filter values that alter the query's intended scope, enabling them to match arbitrary documents and overwrite their content with attacker-supplied data. The vulnerability requires authenticated access and workflow modification privileges but operates over the network without additional user interaction, resulting in a CVSS 3.1 score of 7.7 (HIGH).

Business impact

Workflow automation systems often connect to databases containing sensitive operational data. This vulnerability allows authenticated internal users (developers, workflow administrators) to silently corrupt or modify database records beyond their intended scope—potentially affecting production data pipelines, customer records, or transaction logs. The integrity impact is significant because overwritten documents may not trigger alerts, leading to data loss or compliance violations. Organizations relying on n8n for critical data operations face risks of undetected data manipulation and potential business process disruption.

Affected systems

n8n versions prior to 2.24.0 are affected. Any deployment running an older version with the MongoDB node enabled is at risk if users with workflow edit permissions are not fully trusted or if their credentials are compromised. Self-hosted n8n installations and cloud-hosted instances are equally vulnerable if not patched.

Exploitability

The vulnerability requires an authenticated user account with workflow edit access. No public exploit code is known (KEV status: not listed). The attack is straightforward once access is obtained—an attacker simply modifies the filter parameter in a MongoDB Find And Replace node within an existing or new workflow. The lack of additional complexity (no multi-step exploitation, no user interaction needed beyond workflow execution) makes it a direct path to data corruption for insiders or compromised accounts.

Remediation

Upgrade n8n to version 2.24.0 or later, which includes input validation for MongoDB filter parameters. Organizations should prioritize this patch for instances with sensitive MongoDB databases connected and for installations where multiple users have workflow edit access. Verify successful patching by checking the n8n version in your deployment and testing MongoDB node operations.

Patch guidance

Apply n8n version 2.24.0 or any subsequent release. For self-hosted deployments, update your n8n installation from your configured package repository or Docker image source. For cloud-hosted instances managed by Narative or another provider, verify that your instance has been updated or request an update timeline if not yet patched. After patching, no additional configuration changes are required, though you may wish to audit recently modified workflows to detect any suspicious edits.

Detection guidance

Monitor audit logs for workflows using the MongoDB node that include Find And Replace operations with unusual or suspicious filter values—particularly filters that don't align with the declared workflow intent. Look for unexpected database record modifications that correspond in timing to workflow executions. If possible, review the MongoDB query logs for queries with overly broad or anomalous filter clauses. Examination of workflow edit history can reveal whether accounts with elevated privileges have made suspicious changes to MongoDB node parameters.

Why prioritize this

A CVSS score of 7.7 (HIGH) reflects significant integrity impact and network-accessible attack surface. Although exploitation requires authentication and workflow edit permissions, insider threats and credential compromise are realistic scenarios. The silent nature of data corruption—overwritten documents may go unnoticed—amplifies business risk. Organizations with multi-user n8n instances, especially those connected to production databases, should treat this as a high-priority patch.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) reflects: Network-accessible attack surface (AV:N), low attack complexity once authenticated (AC:L), requirement for low-privilege user authentication (PR:L), no need for user interaction (UI:N), scope change allowing impact beyond the vulnerable component (S:C), no confidentiality breach (C:N), high integrity impact from data overwrite (I:H), and no availability impact (A:N). The scope change is significant—corruption of database records affects downstream systems consuming that data. The lack of confidentiality impact and reliance on authentication prevent a critical rating, but the integrity risk is substantial.

Frequently asked questions