CVE-2026-85167

mediumpriority · track · 26EPSS 0.004 · 34 %ileDEUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.40% (34th) EPSS

CVSS 6.5 · medium

Is it mine?

6 products

Check your exposure

Who says so?

2 sources

cert_bund · nvd

EPSS · scored 2026-10-27

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.3–6.5

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

v4.02.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-943USprimary

affected products (6)

Products and version ranges known to be affected.

n8n n8n <2.35.4all versionscert_bundDE
n8n n8n <2.36.2all versionscert_bundDE
n8n n8n< 2.35.4cert_bundDE
n8n n8n< 2.36.2cert_bundDE
n8n n8n< 2.35.4nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
n8n n8n2.36.0 → 2.36.2nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2936n8n: Mehrere SchwachstellenDeutsch2026-08-19csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery-Angriffe (SSRF) durchzuführen, Informationen offenzulegen und Daten zu manipulieren.

sources

Which sources assert this record, and when.

cert_bund nvd NVD CVE.org MITRE

published 2026-09-03modified 2026-09-03

related (154)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2017-5173US	critical9.8	29.6% (98th)	Exploit	2017-05-19
An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An improper neutralization of speci…
CVE-2026-54350US	critical9.8	0.54% (45th)	Exploit	2026-06-26
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elas…
CVE-2026-25514US	high8.8	0.53% (45th)	Exploit	2026-02-04
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the…
CVE-2026-25513US	high8.8	0.54% (45th)	Exploit	2026-02-04
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the…
CVE-2026-33980US	high8.1	0.40% (34th)	Exploit	2026-03-27
Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases thro…

+149 more

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan