CVE-2026-54313: n8n MongoDB Node SQLi Vulnerability

CVE-2026-54313 Overview

CVE-2026-54313 is a NoSQL injection vulnerability in n8n, an open source workflow automation platform. The flaw affects versions prior to 2.24.0 and resides in the MongoDB node's Find And Replace operation. An authenticated user with workflow edit access can supply a malicious filter value that bypasses validation before reaching MongoDB as a query filter. This allows unintended documents to be matched and overwritten with attacker-controlled content. The issue is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). n8n maintainers patched the vulnerability in version 2.24.0.

Critical Impact
Authenticated users with workflow edit privileges can overwrite arbitrary MongoDB documents connected to n8n workflows, compromising data integrity across the connected database.

Affected Products

n8n workflow automation platform versions prior to 2.24.0
Self-hosted and cloud n8n deployments using the MongoDB node
Workflows leveraging the MongoDB Find And Replace operation

Discovery Timeline

2026-06-23 - CVE-2026-54313 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-54313

Vulnerability Analysis

The vulnerability exists in the MongoDB node's Find And Replace operation within n8n. When a user configures this operation, the node accepts a filter value that determines which documents the database engine matches and updates. n8n passes this filter directly to MongoDB without validating or sanitizing the input. An authenticated user with workflow edit access can craft filter expressions containing MongoDB operators such as $ne, $gt, or $regex to match documents outside the intended scope. The matched documents are then overwritten with attacker-controlled replacement content. This is a classic NoSQL injection pattern where untrusted input is interpreted as query logic rather than literal data.

Root Cause

The root cause is missing input validation on the filter parameter accepted by the MongoDB Find And Replace operation. n8n trusts the workflow editor as a privileged context and does not enforce structural validation on filter objects before forwarding them to the MongoDB driver. Because MongoDB filters are themselves structured documents, any operator the attacker injects becomes part of the executed query.

Attack Vector

Exploitation requires an authenticated account with workflow edit permission. The attacker modifies an existing workflow or creates a new one that uses the MongoDB node configured for Find And Replace. By supplying a filter such as a broad operator expression that matches every document in a collection, the attacker triggers mass overwrites when the workflow executes. The attack succeeds over the network against any n8n instance running a vulnerable version with a configured MongoDB credential. See the GitHub Security Advisory GHSA-jpq7-226w-6cxx for additional technical detail.

Detection Methods for CVE-2026-54313

Indicators of Compromise

Unexpected modifications to MongoDB documents tied to n8n workflow service accounts
Workflow execution logs showing MongoDB Find And Replace operations with broad or operator-laden filters such as {"$ne": null} or {"$gt": ""}
New or recently edited workflows that include the MongoDB node from accounts without an operational need
Sudden growth in MongoDB write volumes correlated with n8n workflow runs

Detection Strategies

Audit n8n workflow definitions for MongoDB node usage and inspect the configured filter expressions for operator syntax rather than literal values
Enable n8n execution logging and forward records to a centralized log platform for query inspection
Correlate MongoDB server audit logs with n8n workflow execution timestamps to identify suspicious replace operations

Monitoring Recommendations

Monitor MongoDB updateMany and findAndModify operations originating from the n8n service account for unusually large match counts
Alert on workflow edit events made by accounts that do not typically modify MongoDB-integrated workflows
Track the n8n release version in use and alert on instances running versions prior to 2.24.0

How to Mitigate CVE-2026-54313

Immediate Actions Required

Upgrade all n8n deployments to version 2.24.0 or later
Review existing workflows that use the MongoDB node and validate that filter values are literal, not operator expressions
Restrict workflow edit permissions to trusted operators only and audit existing role assignments
Rotate MongoDB credentials configured in n8n if exploitation is suspected

Patch Information

The vulnerability is fixed in n8n version 2.24.0. The patch validates filter input passed to the MongoDB Find And Replace operation before forwarding it to the database driver. Refer to the n8n GitHub Security Advisory GHSA-jpq7-226w-6cxx for release notes and remediation details.

Workarounds

Apply least-privilege scoping on the MongoDB user credential used by n8n, limiting it to specific collections and removing broad write rights
Temporarily disable workflows that use the MongoDB Find And Replace operation until the upgrade is complete
Require code review of workflow changes that modify MongoDB node configurations

bash

# Upgrade n8n to the patched release
npm install -g n8n@2.24.0

# Or for Docker deployments
docker pull n8nio/n8n:2.24.0
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.24.0

# Verify the running version
n8n --version