Skip to contentN8n-io vulnerabilities
Newest
- n8nn8n: Git Node Clone and Push Operations Bypass File SandboxCVE-2026-49465Fix available6.0 Medium
- n8nn8n: Python sandbox escapeCVE-2026-49444Fix available7.1 High
- n8nn8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters EndpointCVE-2026-56348Fix available5.3 Medium
- n8nn8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile ParameterCVE-2026-56352Fix available5.3 Medium
- n8nn8n: Cross-user Authorization Bypass in Dynamic Credential OAuth EndpointsCVE-2026-45732Fix available8.3 High
- n8nn8n: Source Control Pull SQL InjectionCVE-2026-44792Fix available8.9 High
- n8nn8n: XML Node Prototype Pollution Patch BypassCVE-2026-44791Fix available9.4 Critical
- n8nn8n: Arbitrary File Read via Git NodeCVE-2026-44790Fix available9.4 Critical
- n8nn8n: HTTP Request Node Pagination Prototype Pollution to RCECVE-2026-44789Public exploitFix available9.4 Critical
- n8nn8n: XML Node Prototype Pollution to RCECVE-2026-42232Fix available9.4 Critical
- n8nn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCECVE-2026-42231Public exploitFix available9.4 Critical
- n8nn8n: XSS via MCP OAuth clientCVE-2026-42235Fix available8.8 High
- n8nn8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key ReplayCVE-2026-42226Fix available7.1 High
- n8nn8n: Python Task Runner Sandbox EscapeCVE-2026-42234Fix available7.1 High
- n8nn8n: Public API Variables IDOR Allows Cross-Project Secret DisclosureCVE-2026-42227Fix available6.0 Medium
- n8nn8n: Unauthenticated Denial of Service via MCP Client RegistrationCVE-2026-42236Fix available8.7 High
- n8nn8n: Hijacking of Unauthenticated Chat ExecutionCVE-2026-42228Public exploitFix available6.3 Medium
- n8nn8n: SQL Injection in SeaTable NodeCVE-2026-42229Fix available5.3 Medium
- n8nn8n: Open Redirect in MCP OAuth Consent FlowCVE-2026-42230Fix available5.1 Medium
- n8nn8n: SQL Injection in Oracle Database Node via Limit FieldCVE-2026-42233Fix available5.3 Medium
- n8nn8n: SQL Injection in Snowflake and MySQL NodesCVE-2026-42237Fix available5.3 Medium
- n8nn8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URLCVE-2026-56359Fix available4.8 Medium
- n8nn8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS FieldCVE-2026-56356Fix available5.1 Medium
- n8nn8n - Cross-Site Scripting and Open Redirect in Form NodeCVE-2026-56354Fix available5.1 Medium
- n8nn8n - Stored Cross-Site Scripting in Form Trigger NodeCVE-2026-56358Fix available5.1 Medium
- n8nn8n Vulnerable to LDAP Filter Injection in LDAP NodeCVE-2026-33751Fix available6.3 Medium
- n8nn8n Vulnerable to XSS via Binary Data Inline HTML RenderingCVE-2026-33749Fix available6.3 Medium
- n8nn8n's Source Control SSH Configuration Uses StrictHostKeyChecking=noCVE-2026-33724Fix available6.3 Medium
- n8nn8n Has External Secrets Authorization Bypass in Credential SavingCVE-2026-33722Fix available7.3 High
- n8nn8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACKCVE-2026-33720Fix available6.3 Medium
- n8nn8n Vulnerable to SQL Injection in Data Table Node via orderByColumn ExpressionCVE-2026-33713Fix available8.7 High
- n8nn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCECVE-2026-33696Fix available9.4 Critical
- n8nn8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account TakeoverCVE-2026-33665Fix available8.8 High
- n8nn8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community EditionCVE-2026-33663Fix available8.5 High
- n8nn8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL ModeCVE-2026-33660Fix available9.4 Critical
- n8nn8n has In-Process Memory Disclosure in its Task RunnerCVE-2026-27496Fix available7.1 High
- n8nn8n - Webhook Forgery via Unsigned POST Requests in ZendeskTriggerCVE-2026-56360Fix available6.3 Medium
- n8nn8n - Guardrail Node Bypass via Crafted InputCVE-2026-56349Fix available6.3 Medium
- n8nn8n - Authentication Bypass in Chat Trigger NodeCVE-2026-56353Fix available6.3 Medium
- n8nn8n - SSO Enforcement Bypass via APICVE-2026-56350Fix available6.0 Medium
- n8nn8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook TriggerCVE-2026-56357Fix available6.3 Medium
- n8nn8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL NodesCVE-2026-56351Fix available5.3 Medium
- n8nn8n Vulnerable to Stored XSS via Various NodesCVE-2026-27578Fix available8.5 High
- n8nn8n: Expression Sandbox Escape Leads to RCECVE-2026-27577Public exploitFix availableEPSS 10.7%9.4 Critical
- n8nn8n has Arbitrary Command Execution via File Write and Git OperationsCVE-2026-27498Fix available9.0 Critical
- n8nn8n has Potential Remote Code Execution via Merge NodeCVE-2026-27497Fix available9.4 Critical
- n8nn8n has a Sandbox Escape in its JavaScript Task RunnerCVE-2026-27495Public exploitFix available9.4 Critical
- n8nn8n has Arbitrary File Read via Python Code Node Sandbox EscapeCVE-2026-27494Fix available7.1 High
- n8nn8n has Unauthenticated Expression Evaluation via Form NodeCVE-2026-27493Fix available9.5 Critical
- n8nDomain allowlist bypass enables credential exfiltrationCVE-2026-25631Fix available5.3 Medium
- Show moreLoading…