PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54313 n8n-io CVE debrief

CVE-2026-54313 is a medium-severity vulnerability in n8n, an open-source workflow automation platform. An authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in version 2.24.0. Users of affected versions should update to 2.24.0 or later to mitigate this risk.

Vendor
n8n-io
Product
n8n
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-25
Advisory published
2026-06-23
Advisory updated
2026-06-25

Who should care

Users of n8n versions prior to 2.24.0 who have workflow edit access should be aware of this vulnerability. This includes administrators and developers who manage workflows in n8n. Updating to version 2.24.0 or later will mitigate this risk.

Technical summary

CVE-2026-54313 is a vulnerability in the n8n workflow automation platform. Specifically, it affects the MongoDB node in the Find And Replace operation. An authenticated user with workflow edit access can provide a malicious filter value that is not validated before being used in a MongoDB query. This allows unintended documents to be matched and overwritten with content controlled by the attacker. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 6.5, indicating a medium severity level. The vulnerability has been fixed in n8n version 2.24.0.

Defensive priority

Defenders should prioritize updating n8n to version 2.24.0 or later. In the meantime, they should monitor workflow edits and MongoDB interactions for suspicious activity.

Recommended defensive actions

  • Update n8n to version 2.24.0 or later.
  • Monitor workflow edits and MongoDB interactions for suspicious activity.
  • Restrict workflow edit access to trusted users.
  • Implement additional logging and monitoring of MongoDB operations.
  • Consider compensating controls such as IP restrictions or network segmentation.

Evidence notes

The CVE-2026-54313 vulnerability was published on June 23, 2026, and last modified on June 25, 2026. The vulnerability is described in the CVE record and the NVD detail page. A mitigation or vendor reference is available on the GitHub advisory page.

Official resources

This article is AI-assisted and based on the supplied source corpus.