Executive brief
n8n is an open-source workflow automation platform that includes an LDAP node for integrating with directory services. A flaw in the LDAP node's filter escape logic allows attackers to inject LDAP metacharacters through user-controlled input, potentially retrieving unintended records or bypassing authentication checks built into workflows. This requires specific configuration where external user input is passed via expressions into LDAP search parameters.
Technical details
The vulnerability is an LDAP Filter Injection (CWE-90) caused by insufficient escaping of user-controlled input in the LDAP node's filter construction logic. When workflows interpolate external user input (from forms, webhooks, or other sources) via expressions into LDAP search filter parameters, LDAP metacharacters pass through unescaped, allowing an attacker to modify the filter logic. The attack requires network access and a specific workflow configuration with user-controlled input connected to the LDAP node, but no authentication or user interaction beyond triggering the vulnerable workflow. An attacker can manipulate filters to retrieve unintended directory records or bypass authentication logic. Patches are available in n8n versions 1.123.27, 2.13.3, and 2.14.1 or later.
Affected products
- n8n n8n < 1.123.27, 2.0.0-rc.0 to < 2.13.3, 2.14.0
Timeline
- 2026-03-25: disclosed
- 2026-03-26: patched: Fixed in versions 1.123.27, 2.13.3, and 2.14.1