Skip to contentN8n-io N8n vulnerabilities
- n8n-io n8nn8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter KeyCVE-2026-1263814.9 Medium
- n8n-io n8nn8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret ResetCVE-2026-1263826.3 Medium
- n8n-io n8nn8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image NodeCVE-2026-1263847.7 High
- n8n-io n8nn8n before 1.123.89 NoSQL Injection via MongoDB Node Update KeyCVE-2026-1263835.3 Medium
- n8n-io n8nn8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential CallbackCVE-2026-1263854.8 Medium
- n8n-io n8nn8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload ToolCVE-2026-1263876.0 Medium
- n8n-io n8nn8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client RegistrationCVE-2026-1263865.1 Medium
- n8n-io n8nn8n before 2.46.1 Credential Leak via Cross-Origin Redirects in NodesCVE-2026-1263886.3 Medium
- n8n-io n8nn8n before 1.123.89 NocoDB Node API Token Leak via Attachment DownloadCVE-2026-1263906.3 Medium
- n8n-io n8nn8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded ChatCVE-2026-1263896.3 Medium
- n8n-io n8nn8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox EscapeCVE-2026-1263917.7 High
- n8n-io n8nn8n from 2.14.0 through 2.46.3 Path Traversal via Databricks NodeCVE-2026-1195578.2 High
- n8n-io n8nn8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function NodesCVE-2026-1194088.7 High
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack TriggerCVE-2026-1186796.9 Medium
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History CompactionCVE-2026-1186787.1 High
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker InstanceCVE-2026-1186775.9 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check BypassCVE-2026-1186765.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflowCVE-2026-1186755.1 Medium
- n8n-io n8nn8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data TablesCVE-2026-1186498.7 High
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox PolicyCVE-2026-1186488.4 High
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution DataCVE-2026-1186475.3 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files NodeCVE-2026-1186467.1 High
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where ParameterCVE-2026-1186457.0 High
- n8n-io n8nn8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context InheritanceCVE-2026-1186445.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error DataCVE-2026-1186435.3 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-WorkflowsCVE-2026-1186425.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint NodesCVE-2026-1186416.9 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization BypassCVE-2026-1186405.3 Medium
- n8n-io n8nn8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSONCVE-2026-1108537.1 High
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook ResolutionCVE-2026-1108526.3 Medium
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create EndpointCVE-2026-1108516.1 Medium
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node ParametersCVE-2026-1108507.2 High
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File PreviewCVE-2026-1108497.2 High
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection MergeCVE-2026-1108486.0 Medium
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss ParameterCVE-2026-1108477.0 High
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-WebhookCVE-2026-1108467.0 High
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log OperationCVE-2026-1108457.7 High
- n8n-io n8nn8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-WorkflowsCVE-2026-1108447.2 High
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize EndpointCVE-2026-1108438.2 High
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation InterpreterCVE-2026-1108427.7 High
- n8n-io n8nn8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool ApprovalCVE-2026-1108416.1 Medium
- n8n-io n8nn8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query FieldCVE-2026-1108407.0 High
- n8n-io n8nn8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait NodeCVE-2026-1032606.3 Medium
- n8n-io n8nn8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic CredentialsCVE-2026-1032598.5 High
- n8n-io n8nn8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter InterpolationCVE-2026-1032586.9 Medium
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n NodeCVE-2026-1032578.1 High
- n8n-io n8nn8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication HookCVE-2026-1032567.1 High
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via SupabaseCVE-2026-1032557.1 High
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL GenerationCVE-2026-1032547.0 High
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop TableCVE-2026-1032537.0 High
- Show olderLoading…