CVE-2026-118645

Published 28 October 2026 · tracked since 29 October 2026

Description

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-118683 HIGH 8.8
• CVE-2026-118680 MEDIUM 4.4
• CVE-2026-118265 MEDIUM 5.3
• CVE-2026-118641 HIGH 7.5
• CVE-2026-118257 HIGH 7.2
• CVE-2026-106484 MEDIUM 4.4
• CVE-2026-79656 MEDIUM 6
• CVE-2026-110181 MEDIUM 6.5
• CVE-2026-105620 MEDIUM 6.5
• CVE-2026-105613 MEDIUM 4.7

→ Open the live CVE board · all tools