CVE-2026-85167: Improper Neutralization of Special Elements in Data Query Logic in n8n-io n8n

CVE-2026-85167 describes a query injection vulnerability in n8n prior to versions 2.35.4 and 2.36.2. The flaw exists in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which construct JSON queries by directly embedding user-supplied expression values. Malicious input containing quote and brace characters can prematurely close the intended JSON field and inject additional query operators, effectively transforming a restricted single-document query into a broader full-collection read. This improper neutralization of special elements in data query logic can lead to unauthorized data exposure. The vulnerability affects the cloud service version of n8n, and a patch is available from the vendor.

Successful exploitation allows an attacker with limited privileges to manipulate query logic in Elasticsearch and Firestore operations, potentially escalating a single-document lookup into a full-collection read. This could lead to unauthorized access to a larger set of data than intended, increasing data exposure risk. The vulnerability does not require user interaction and has no known exploits in the wild at this time.

Since this is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their instance is updated to at least version 2.35.4 or 2.36.2 or later, where the vulnerability is patched. No additional user action is required if the vendor has applied the fix. Patch status is confirmed as available.