CVE-2026-33751

# PoC Concept for LDAP Injection in n8n # This demonstrates how an attacker might craft input to manipulate the LDAP filter. # Scenario: An n8n workflow takes a 'username' from a Webhook and uses it in an LDAP node. # The vulnerable filter construction might look like: (uid={{ $json.username }}) # Malicious input payload payload = "admin)(|(userPassword=*))" # If the application does not escape metacharacters, the resulting LDAP filter becomes: # (uid=admin)(|(userPassword=*))) # This could potentially bypass authentication or return unintended records. print(f"Injecting payload: {payload}")

{"cve": {"id": "CVE-2026-33751", "sourceIdentifier": "[email protected]", "published": "2026-03-25T19:16:51.670", "lastModified": "2026-03-27T19:28:01.093", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 1.123.27, 2.13.3, and 2.14.1, a flaw in the LDAP node's filter escape logic allowed LDAP metacharacters to pass through unescaped when user-controlled input was interpolated into LDAP search filters. In workflows where external user input is passed via expressions into the LDAP node's search parameters, an attacker could manipulate the constructed filter to retrieve unintended LDAP records or bypass authentication checks implemented in the workflow. Exploitation requires a specific workflow configuration. The LDAP node must be used with user-controlled input passed via expressions (e.g., from a form or webhook). The issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, disable the LDAP node by adding `n8n-nodes-base.ldap` to the `NODES_EXCLUDE` environment variable, and/or avoid passing unvalidated external user input into LDAP node search parameters via expressions. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}, {"lang": "es", "value": "n8n es una plataforma de automatización de flujos de trabajo de código abierto. Antes de las versiones 1.123.27, 2.13.3 y 2.14.1, un fallo en la lógica de escape de filtros del nodo LDAP permitía que los metacaracteres LDAP pasaran sin escapar cuando la entrada controlada por el usuario se interpolaba en los filtros de búsqueda LDAP. En flujos de trabajo donde la entrada de usuario externa se pasa a través de expresiones a los parámetros de búsqueda del nodo LDAP, un atacante podría manipular el filtro construido para recuperar registros LDAP no deseados o eludir las comprobaciones de autenticación implementadas en el flujo de trabajo. La explotación requiere una configuración de flujo de trabajo específica. El nodo LDAP debe usarse con entrada controlada por el usuario pasada a través de expresiones (por ejemplo, desde un formulario o webhook). El problema se ha solucionado en las versiones de n8n 1.123.27, 2.13.3 y 2.14.1. Los usuarios deben actualizar a una de estas versiones o posteriores para remediar la vulnerabilidad. Si la actualización no es posible de inmediato, los administradores deben considerar las siguientes mitigaciones temporales: Limitar los permisos de creación y edición de flujos de trabajo solo a usuarios de plena confianza, deshabilitar el nodo LDAP añadiendo `n8n-nodes-base.ldap` a la variable de entorno `NODES_EXCLUDE`, y/o evitar pasar entrada de usuario externa no validada a los parámetros de búsqueda del nodo LDAP a través de expresiones. Estas soluciones provisionales no remedian completamente el riesgo y solo deben usarse como medidas de mitigación a corto plazo."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.8, "base ... (truncated)