n8n OData filter injection: Outlook and SharePoint advisory
What the n8n OData filter injection advisory published on October 14, 2026 says about affected operations, patched versions and temporary mitigation.
Checked against the cited sources on .
What the n8n OData filter injection advisory announced
The n8n OData filter injection advisory published on October 14, 2026 announces that fixes are available and recommends that affected users upgrade. Advisory GHSA-mgpr-56r4-5c67 concerns unescaped OData filter values in Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update.
The n8n Outlook SharePoint security update matters when workflows bind untrusted input into the affected fields. The publication date identifies the announcement; it does not establish when exploitation began or when patches first became available.
Which operations and inputs need attention
The advisory describes two possible consequences of OData query injection: Outlook can return the bound mailbox’s entire contact list, and SharePoint can write submitted values to an unintended list item. Both remain within the stored credential’s scope. These are announced vulnerability consequences, not evidence of exploitation.
For teams reviewing the n8n Microsoft Outlook vulnerability and the affected Microsoft SharePoint v1 workflows, the following inventory is our suggested way to prioritize review; it does not establish that a workflow is safe.
Upgrade to a listed patched version
For n8n OData filter injection, the advisory lists fixes in versions 1.123.85, 2.44.1 and 2.43.5 and recommends upgrading to one of those versions or later. It does not name release channels for those version lines or provide deployment-specific upgrade commands or verification procedures.
We think the practical priority is to give the upgrade a clear owner and make workflow review part of the same response. We would use the inventory to organize that work rather than treat input inspection as a substitute for patching.
If an immediate upgrade must wait
The advisory includes deactivating affected workflows until the instance is patched among its temporary mitigations. It explicitly warns that workarounds do not fully remediate the risk and does not specify operational recovery steps or a complete alternative remediation.
In our view, a temporary mitigation should have a named owner and an explicit plan to reach a patched version. Calling it temporary should describe a decision the team will revisit, not an indefinite operating arrangement.
What the announcement leaves unspecified
The n8n OData filter injection advisory does not state whether n8n Cloud instances are automatically patched, distinguish editions or hosted plans, or describe wider impact. It also does not quantify affected installations or exploitation prevalence. Teams should not infer those details from this announcement.
Our editorial suggestion is to record unresolved deployment questions alongside the remediation owner. This article explains the announcement and its immediate response choices; it is not a deployment-specific upgrade or troubleshooting procedure.
