A significant security flaw has been identified in n8n, the popular open-source workflow automation platform. This vulnerability, tracked as CVE-2026-54313, allows an attacker with specific access to manipulate data within MongoDB databases linked to n8n workflows. It highlights a critical issue where malicious input can be used to overwrite information, posing a serious risk to data integrity.
CVE Details
- Product: n8n
- Published Date: June 23, 2026
- Severity: HIGH
- Status: Analyzed
Affected Products
This vulnerability impacts versions of n8n prior to 2.24.0. Users running any version older than 2.24.0 are at risk.
Current Status
The vulnerability is currently in an ‘Analyzed’ state. This means it has been publicly disclosed and evaluated, and information regarding its nature and potential impact is available.
Severity Level
The vulnerability is rated as HIGH severity, with a CVSS score of 7.7. The GitHub security advisory, however, lists it as ‘Moderate’ with a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N). Regardless of the slight score difference between initial reporting and the advisory, the core concern remains: an authenticated attacker with workflow edit access can exploit this flaw. This can lead to unauthorized modification of data within MongoDB databases, potentially overwriting important documents with attacker-controlled content. This could compromise the integrity of your data.
Possible Solutions
The good news is that a fix is available. Users are strongly advised to update their n8n installations to version 2.24.0 or later. This update directly addresses the flaw and secures your workflows against this specific NoSQL injection.
If an immediate upgrade is not feasible, temporary mitigation steps include:
- Restricting workflow creation and editing permissions strictly to fully trusted administrators or users.
- Disabling the vulnerable MongoDB node. This can be done by adding n8n-nodes-base.mongoDb to your NODES_EXCLUDE environment variable.
These workarounds should only be considered short-term solutions as they do not fully eliminate the risk. A full upgrade is the most effective defense.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx
