Is CVE-2026-118645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118645 being exploited in the wild.

How severe is CVE-2026-118645?

High severity, with a CVSS score of 8.7, published 28 October 2026.

Which products and versions are affected?

N8n before 1.123.85, 2.x before 2.43.5, 2.44.x before 2.44.1.

How is CVE-2026-118645 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-118645?

Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118645: n8n Quick Base node filter injection vulnerability

CVE-2026-118645 · Severity: high · CVSS 8.7 · Published 2026-10-28

n8n is a workflow automation platform that connects business applications and APIs. The Quick Base node, which manages records in Quick Base databases, fails to properly validate filter parameters, allowing attackers to inject malicious filter logic. An attacker can hijack workflows that build filters from untrusted sources like webhooks to retrieve all records or delete all records using the workflow's database credentials.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-118645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118645 being exploited in the wild.
How severe is CVE-2026-118645?: High severity, with a CVSS score of 8.7, published 28 October 2026.
Which products and versions are affected?: N8n before 1.123.85, 2.x before 2.43.5, 2.44.x before 2.44.1.
Is there a fix for CVE-2026-118645?: Yes: fixed in n8n 1.123.85, 2.43.5, 2.44.1. Until then: Restrict n8n instance access to fully trusted users only. Audit active workflows using the Quick Base node and ensure the Where parameter does not incorporate untrusted external data via expressions. Apply network-level controls to restrict access to webhook endpoints that feed into Quick Base record:delete or record:getAll operations. Alternatively, disable the Quick Base node by adding n8n-nodes-base.quickBase to the NODES_EXCLUDE environment variable if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118645 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-118645?: Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: n8n 1.123.85, 2.43.5, 2.44.1

Restrict n8n instance access to fully trusted users only. Audit active workflows using the Quick Base node and ensure the Where parameter does not incorporate untrusted external data via expressions. Apply network-level controls to restrict access to webhook endpoints that feed into Quick Base record:delete or record:getAll operations. Alternatively, disable the Quick Base node by adding n8n-nodes-base.quickBase to the NODES_EXCLUDE environment variable if not required.

Technical details

The Quick Base node sends the Where filter parameter directly to the Quick Base API as raw query text without sanitization. When a workflow constructs this filter from untrusted input (e.g., webhook data), an attacker can break out of the intended filter logic via injection. This enables unauthorized data retrieval (Get Many operation) or mass deletion (Delete operation) with the privileges of the workflow's credential. The vulnerability is in the Quick Base node component and requires low privileges and network access via webhook endpoints.

Affected products

n8n n8n before 1.123.85, 2.x before 2.43.5, 2.44.x before 2.44.1

Timeline

2026-10-14: disclosed
2026-10-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.