n8n’s LDAP node contains a flaw in its filter‑escaping logic that allows LDAP metacharacters to cross the boundary when user‑controlled data is interpolated into search filters. This enables an attacker to craft a filter that returns records the workflow should not see or bypass workflow‑level authentication checks. The weakness corresponds to CWE‑90 and can lead to confidential data leakage or unauthorized access within the target directory.

The vulnerability affects n8n workloads running any of the following versions: 1.122.0 through 1.123.26, 2.13.0 through 2.13.2, and 2.14.0. Users of n8n 2.14.1 or newer, or 1.123.27 or newer, are not affected. The impact is limited to systems that deploy the LDAP node within workflows that accept externally supplied expressions, such as forms or webhooks, and do not sanitize that input before passing it to the node.

The CVSS score of 6.3 indicates a medium risk if the required workflow conditions are met. The EPSS score of less than 1% suggests low exploit probability at this time, and the vulnerability is not in the CISA KEV list. An attacker would need an operational n8n instance with the LDAP node enabled, a workflow that passes user input to the node via an expression, and the ability to supply crafted LDAP filter components. Successful exploitation can expose sensitive directory data or allow an attacker to bypass authentication embedded in the workflow.