CVE-2026-118645

{
  "etk_id": "ETK-2026-2909",
  "cve_id": "CVE-2026-118645",
  "display_id": "CVE-2026-118645",
  "ghsa_id": "GHSA-6vpf-74v5-9qcm",
  "euvd_id": "EUVD-2026-112376",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Filter injection in the n8n Quick Base node",
  "summary": "n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 are affected in the Quick Base node. An attacker may alter Quick Base query filtering to expose or delete records available to the workflow credential when untrusted input is incorporated into the node's filter.",
  "mitigation": "Upgrade n8n to 1.123.85, 2.43.5, or 2.44.1 or later, as appropriate for the release line. Until upgraded, do not use untrusted input to construct Quick Base filters and limit workflow credential permissions.",
  "vendor": "n8n-io",
  "product": "n8n",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.123.85"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.123.85"
      ],
      "package_name": "n8n",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.44.0, < 2.44.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.44.1"
      ],
      "package_name": "n8n",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, < 2.43.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.43.5"
      ],
      "package_name": "n8n",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.060907183333335,
  "t0_at": "2026-10-28T18:59:44.935000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T18:59:44.935000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T18:59:44.935000+00:00",
      "url": "https://github.com/advisories/GHSA-6vpf-74v5-9qcm"
    }
  }
}