N8n-io vulnerabilities

Products

• N8n 228

Newest

• n8n-io n8n n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node CVE-2026-119557 8.2 HighOctober 30, 2026
• n8n-io n8n n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes CVE-2026-119408 8.7 HighOctober 30, 2026
• n8n-io n8n n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger CVE-2026-118679 6.9 MediumOctober 28, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction CVE-2026-118678 7.1 HighOctober 28, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance CVE-2026-118677 5.9 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass CVE-2026-118676 5.1 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow CVE-2026-118675 5.1 MediumOctober 28, 2026
• n8n-io n8n n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables CVE-2026-118649 8.7 HighOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy CVE-2026-118648 8.4 HighOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data CVE-2026-118647 5.3 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node CVE-2026-118646 7.1 HighOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter CVE-2026-118645 7.0 HighOctober 28, 2026
• n8n-io n8n n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance CVE-2026-118644 5.1 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data CVE-2026-118643 5.3 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows CVE-2026-118642 5.1 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes CVE-2026-118641 6.9 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass CVE-2026-118640 5.3 MediumOctober 28, 2026
• n8n-io n8n n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON CVE-2026-110853 7.1 HighOctober 14, 2026
• n8n-io n8n n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution CVE-2026-110852 6.3 MediumOctober 14, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint CVE-2026-110851 6.1 MediumOctober 14, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters CVE-2026-110850 7.2 HighOctober 14, 2026
• n8n-io n8n n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview CVE-2026-110849 7.2 HighOctober 14, 2026
• n8n-io n8n n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge CVE-2026-110848 6.0 MediumOctober 14, 2026
• n8n-io n8n n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter CVE-2026-110847 7.0 HighOctober 14, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook CVE-2026-110846 7.0 HighOctober 14, 2026
• n8n-io n8n n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation CVE-2026-110845 7.7 HighOctober 14, 2026
• n8n-io n8n n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows CVE-2026-110844 7.2 HighOctober 14, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint CVE-2026-110843 8.2 HighOctober 14, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter CVE-2026-110842 7.7 HighOctober 14, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval CVE-2026-110841 6.1 MediumOctober 14, 2026
• n8n-io n8n n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field CVE-2026-110840 7.0 HighOctober 14, 2026
• n8n-io n8n n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node CVE-2026-103260 6.3 MediumOctober 1, 2026
• n8n-io n8n n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials CVE-2026-103259 8.5 HighOctober 1, 2026
• n8n-io n8n n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation CVE-2026-103258 6.9 MediumOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node CVE-2026-103257 8.1 HighOctober 1, 2026
• n8n-io n8n n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook CVE-2026-103256 7.1 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase CVE-2026-103255 7.1 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation CVE-2026-103254 7.0 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table CVE-2026-103253 7.0 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint CVE-2026-103252 7.1 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub CVE-2026-103251 7.5 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory CVE-2026-103250 7.0 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator CVE-2026-103249 6.9 MediumOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase CVE-2026-103248 7.1 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80 Credential Tampering via Duplicate Node IDs CVE-2026-103247 5.8 MediumOctober 1, 2026
• n8n-io n8n n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection CVE-2026-103246 8.3 HighOctober 1, 2026
• n8n-io n8n n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification CVE-2026-103245 6.9 MediumOctober 1, 2026
• n8n-io n8n n8n before 1.123.76 Improper Authorization via Source Control Push CVE-2026-92588 5.9 MediumSeptember 16, 2026
• n8n-io n8n n8n before 1.123.76 Sandbox Escape via Git Relative URL CVE-2026-92587 5.3 MediumSeptember 16, 2026
• n8n n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint CVE-2026-86075 Fix available 8.7 HighSeptember 8, 2026
• Show olderLoading…