n8n security tracker

Showing all 125 tracked advisories.

• Critical 9.9

  CVE-2026-85165

  n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in…

  +

  Affected < 2.35.4 and 2.36.0 to < 2.36.3 Fixed 2.35.4 / 2.36.3 3 September 2026

  Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.8

  CVE-2026-77070

  n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find…

  +

  Affected < 1.123.69 and 2.33.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  An attacker who can influence the resolved query (e.g., via externally-controlled data) can inject operators such as $ne or $where, turning an intended single-document lookup into full-collection disclosure, full-collection deletion, or other operations on the database server.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.8

  CVE-2026-77071

  n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase…

  +

  Affected < 1.123.69 and 2.33.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-72765

  n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation

  +

  Affected 2.31.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 2.31.5 / 2.32.1 11 August 2026

  An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.8

  CVE-2026-65590

  n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

  +

  Affected < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 2.29.8 / 2.30.1 22 July 2026

  Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.6

  CVE-2026-56351

  n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes…

  +

  Affected < 2.4.0 Fixed 2.4.0 24 June 2026

  Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 10.0

  CVE-2026-54309

  n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

  +

  Affected < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 2.25.7 / 2.26.2 16 June 2026

  Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated caller can access browser-control capabilities including navigation, JavaScript evaluation, and cookie and storage access against the user's real browser profile. This issue only affects instances where @n8n/mcp-browser is run with the HTTP transport (--transport http). This vulnerability is fixed in 2.25.7 and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.9

  CVE-2026-54305

  n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

  +

  Affected < 1.123.55 and 2.0.0 to < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 1.123.55 / 2.25.7 / 2.26.2 16 June 2026

  Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope checks on the target workflow or credential. An authenticated user with no project membership or credential sharing relationship could enumerate credential identifiers, names, and types referenced by any private workflow in the instance, initiate an OAuth authorization flow against another user's credential to overwrite its stored tokens with tokens bound to an account they control, or revoke another user's stored credential tokens entirely. Workflows relying on a hijacked credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of integrations. Token revocation would break affected workflows. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.6

  CVE-2026-54307

  n8n: Credential Exfiltration via Permission Bypass

  +

  Affected < 1.123.55 and 2.0.0 to < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 1.123.55 / 2.25.7 / 2.26.2 16 June 2026

  Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access. This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.9

  CVE-2026-54310

  n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

  +

  Affected < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 2.25.7 / 2.26.2 16 June 2026

  Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.9

  CVE-2026-56348

  n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass

  +

  Affected < 2.20.0 Fixed 2.20.0 19 May 2026

  Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.0

  CVE-2026-44792

  n8n Has a Source Control Pull SQL Injection

  +

  Affected < 1.123.43 and 2.0.0 to < 2.20.7 and 2.21.0 to < 2.22.1 Fixed 1.123.43 / 2.20.7 / 2.22.1 14 May 2026

  Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git repository connected to an n8n Source Control configuration could commit a malicious Data Table JSON file containing a crafted column name. When an administrator performed a Source Control Pull, n8n imported the file and could lead to SQL injection on the internal PostgreSQL instance. Exploitation requires the n8n instance uses PostgreSQL as its database backend, the Source Control feature is enabled and connected to a repository the attacker can write to, and an administrator triggers a Source Control Pull. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.9

  CVE-2026-44791

  n8n Has an XML Node Prototype Pollution Patch Bypass

  +

  Affected < 1.123.43 and 2.0.0 to < 2.20.7 and 2.21.0 to < 2.22.1 Fixed 1.123.43 / 2.20.7 / 2.22.1 14 May 2026

  Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.4

  CVE-2026-44790

  n8n Has an Arbitrary File Read via Git Node

  +

  Affected < 1.123.43 and 2.0.0 to < 2.20.7 and 2.21.0 to < 2.22.1 Fixed 1.123.43 / 2.20.7 / 2.22.1 14 May 2026

  Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.9

  CVE-2026-44789

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.43 and 2.0.0 to < 2.20.7 and 2.21.0 to < 2.22.1 Fixed 1.123.43 / 2.20.7 / 2.22.1 14 May 2026

  Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.4

  CVE-2026-42232

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.4

  CVE-2026-42231

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.6

  CVE-2026-42235

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted client_name. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that access, a toast notification would render the injected script. Clicking the link would execute arbitrary JavaScript in the victim's authenticated n8n browser session, enabling credential and session token theft, workflow manipulation, or privilege escalation. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.8

  CVE-2026-42233

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allowed user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the Limit field (e.g., from a webhook), an attacker could inject arbitrary SQL and exfiltrate data from the connected Oracle database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.4

  CVE-2026-33660

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.27 and 2.0.0 to < 2.13.3 and 2.14.0 to < 2.14.1 Fixed 1.123.27 / 2.13.3 / 2.14.1 25 March 2026

  Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use the Merge node's "Combine by SQL" mode to read local files on the n8n host and achieve remote code execution. The AlaSQL sandbox did not sufficiently restrict certain SQL statements, allowing an attacker to access sensitive files on the server or even compromise the instance. The issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.26. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Merge node by adding `n8n-nodes-base.merge` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.4

  CVE-2026-33696

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.27 and 2.0.0 to < 2.13.3 and 2.14.0 to < 2.14.1 Fixed 1.123.27 / 2.13.3 / 2.14.1 25 March 2026

  Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the XML and the GSuiteAdmin nodes. By supplying a crafted parameters as part of node configuration, an attacker could write attacker-controlled values onto `Object.prototype`. An attacker could use this prototype pollution to achieve remote code execution on the n8n instance. The issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.27. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.0

  CVE-2026-33749

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.27 and 2.0.0 to < 2.13.3 and 2.14.0 to < 2.14.1 Fixed 1.123.27 / 2.13.3 / 2.14.1 25 March 2026

  Prior to versions 1.123.27, 2.13.3, and 2.14.1, an authenticated user with permission to create or modify workflows could craft a workflow that produces an HTML binary data object without a filename. The `/rest/binary-data` endpoint served such responses inline on the n8n origin without `Content-Disposition` or `Content-Security-Policy` headers, allowing the HTML to render in the browser with full same-origin JavaScript access. By sending the resulting URL to a higher-privileged user, an attacker could execute JavaScript in the victim's authenticated session, enabling exfiltration of workflows and credentials, modification of workflows, or privilege escalation to admin. The issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or restrict network access to the n8n instance to prevent untrusted users from accessing binary data URLs. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.5

  CVE-2026-27493

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.22 and 2.0.0 to < 2.9.3 and 2.10.0 to < 2.10.1 Fixed 1.123.22 / 2.9.3 / 2.10.1 25 February 2026

  Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When chained with an expression sandbox escape, this could escalate to remote code execution on the n8n host. The vulnerability requires a specific workflow configuration to be exploitable. First, a form node with a field interpolating a value provided by an unauthenticated user, e.g. a form submitted value. Second, the field value must begin with an `=` character, which caused n8n to treat it as an expression and triggered a double-evaluation of the field content. There is no practical reason for a workflow designer to prefix a field with `=` intentionally — the character is not rendered in the output, so the result would not match the designer's expectations. If added accidentally, it would be noticeable and very unlikely to persist. An unauthenticated attacker would need to either know about this specific circumstance on a target instance or discover a matching form by chance. Even when the preconditions are met, the expression injection alone is limited to data accessible within the n8n expression context. Escalation to remote code execution requires chaining with a separate sandbox escape vulnerability. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Review usage of form nodes manually for above mentioned preconditions, disable the Form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable, and/or disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-27494

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.22 and 2.0.0 to < 2.9.3 and 2.10.0 to < 2.10.1 Fixed 1.123.22 / 2.9.3 / 2.10.1 25 February 2026

  Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the Python Code node to escape the sandbox. The sandbox did not sufficiently restrict access to certain built-in Python objects, allowing an attacker to exfiltrate file contents or achieve RCE. On instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only., and/or disable the Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-27495

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.22 and 2.0.0 to < 2.9.3 and 2.10.0 to < 2.10.1 Fixed 1.123.22 / 2.9.3 / 2.10.1 25 February 2026

  Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary code outside the sandbox boundary. On instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or use external runner mode (`N8N_RUNNERS_MODE=external`) to limit the blast radius. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.4

  CVE-2026-27497

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.22 and 2.0.0 to < 2.9.3 and 2.10.0 to < 2.10.1 Fixed 1.123.22 / 2.9.3 / 2.10.1 25 February 2026

  Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could leverage the Merge node's SQL query mode to execute arbitrary code and write arbitrary files on the n8n server. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Merge node by adding `n8n-nodes-base.merge` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.0

  CVE-2026-27498

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.8 and 2.0.0 to < 2.2.0 Fixed 1.123.8 / 2.2.0 25 February 2026

  Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary shell commands on the n8n host. The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-27577

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.22 and 2.0.0 to < 2.9.3 and 2.10.0 to < 2.10.1 Fixed 1.123.22 / 2.9.3 / 2.10.1 25 February 2026

  Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-25049

  Expression escape to remote code execution

  +

  Authenticated Affected < 1.123.17 and 2.0.0 to < 2.5.2 Fixed 1.123.17 / 2.5.2 4 Feb 2026

  A follow-up to the expression-evaluation flaws. An authenticated user with permission to modify workflows can craft expressions in workflow parameters that break out and run system commands on the n8n host.

  Upgrade to 1.123.17 or 2.5.2. Until you can, limit who has permission to create or edit workflows, and review recent workflow changes for anything unexpected.

  Read the full advisory at the GitHub Advisory Database

• Critical 9.9

  CVE-2026-25052

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.18 and 2.0.0 to < 2.5.0 Fixed 1.123.18 / 2.5.0 4 February 2026

  Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of any user on the instance. This issue has been patched in versions 1.123.18 and 2.5.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-25053

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.0 and 2.0.0 to < 2.5.0 Fixed 1.123.0 / 2.5.0 4 February 2026

  Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. This issue has been patched in versions 1.123.10 and 2.5.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.4

  CVE-2026-25056

  n8n is an open source workflow automation platform

  +

  Affected < 1.118.0 and 2.0.0 to < 2.4.0 Fixed 1.118.0 / 2.4.0 4 February 2026

  Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remote code execution. This issue has been patched in versions 1.118.0 and 2.4.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-25115

  n8n is an open source workflow automation platform

  +

  Affected < 2.4.8 Fixed 2.4.8 4 February 2026

  Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. This issue has been patched in version 2.4.8.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.4

  CVE-2026-21893

  n8n is an open source workflow automation platform

  +

  Affected 0.187.0 to < 1.120.3 Fixed 1.120.3 4 February 2026

  From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-1470

  n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system

  +

  Affected < 1.123.17 and 2.0.0 to < 2.4.5 and 2.5.0 to < 2.5.1 Fixed 1.123.17 / 2.4.5 / 2.5.1 27 January 2026

  Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2026-0863

  Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox…

  +

  Affected < 1.123.15 and 2.0.0 to < 2.3.6 and 2.4.0 to < 2.4.3 Fixed 1.123.15 / 2.3.6 / 2.4.3 18 January 2026

  The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 10.0

  CVE-2026-21858

  Unauthenticated remote code execution

  +

  Unauthenticated Affected 1.65.0 to < 1.121.0 Fixed 1.121.0 7 Jan 2026

  Improper input validation in form-based workflows lets an unauthenticated attacker read arbitrary files from the server and forge an admin session token. Chained with CVE-2025-68613 it becomes a full unauthenticated RCE. Public proof-of-concept exists.

  Upgrade to 1.121.0 now. This is unauthenticated with public exploit code. If you can't patch today, block public access to webhook and form endpoints and put the instance behind a VPN or allowlist.

  Read the full advisory at Canadian Centre for Cyber Security AL26-001

• Critical 9.9

  CVE-2026-21877

  Code injection via arbitrary file write to privileged RCE

  +

  Authenticated Affected 0.123.0 to 1.121.2 Fixed 1.121.3 7 Jan 2026

  An authenticated user can write files to arbitrary paths on the host, leading to privileged code execution. Disclosed alongside Ni8mare in the same January advisory wave.

  Upgrade to 1.121.3. Review who has editor access, and rotate any credentials stored on the host if you suspect exposure.

  Read the full advisory at Canadian Centre for Cyber Security AL26-001

• Critical 9.9 Actively exploited

  CVE-2025-68613

  Expression-language injection to RCE

  +

  Authenticated Affected 0.211.0 to 1.120.3 and 1.121.0 Fixed 1.120.4 / 1.121.1 / 1.122.0 19 Dec 2025

  The workflow expression evaluator can be abused to run arbitrary code. Added to the CISA Known Exploited Vulnerabilities catalog on 11 March 2026, with a federal patch deadline of 25 March 2026. NVD scores this 8.8; the vendor CNA scores it 9.9.

  Patch now to 1.120.4, 1.121.1, or 1.122.0. This is on the CISA exploited list, so treat it as urgent and check host logs for signs of prior compromise.

  Read the full advisory at NVD / CISA KEV

• Critical 9.4

  CVE-2025-65964

  n8n is an open source workflow automation platform

  +

  Affected 0.123.1 to < 1.119.2 Fixed 1.119.2 9 December 2025

  Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations. Exploitation requires the ability to create or modify an n8n workflow using the Git node. This issue is fixed in version 1.119.2. Workarounds include excluding the Git Node (Docs) and avoiding cloning or interacting with untrusted repositories using the Git Node.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• Critical 9.9

  CVE-2025-68668

  Sandbox bypass in the Python Code node to RCE

  +

  Authenticated Affected 1.0.0 to < 2.0.0 Fixed 2.0.0 Dec 2025

  The Python Code node runs on Pyodide inside a sandbox. An authenticated user can break out of that sandbox and execute code on the host. Fixed in the 2.0 line.

  Upgrade to 2.0.0 or later. In the meantime, restrict the Python Code node to trusted users only.

  Read the full advisory at Rapid7 research

• High 7.6

  CVE-2026-86073

  n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

  +

  Affected < 2.37.7 and 2.38.0 to < 2.38.1 Fixed 2.37.7 / 2.38.1 8 September 2026

  Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-86074

  n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

  +

  Affected < 2.37.7 and 2.38.0 to < 2.38.2 Fixed 2.37.7 / 2.38.2 8 September 2026

  Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.7

  CVE-2026-86075

  n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

  +

  Affected < 2.37.7 and 2.38.0 to < 2.38.2 Fixed 2.37.7 / 2.38.2 8 September 2026

  Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-86076

  n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution

  +

  Affected < 1.123.76 and 2.0.0 to < 2.37.7 and 2.38.0 to < 2.38.2 Fixed 1.123.76 / 2.37.7 / 2.38.2 8 September 2026

  Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-86081

  n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

  +

  Affected See advisory Fixed See advisory 8 September 2026

  Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-86082

  n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

  +

  Affected < 1.123.76 and 2.0.0 to < 2.37.7 and 2.38.0 to < 2.38.2 Fixed 1.123.76 / 2.37.7 / 2.38.2 8 September 2026

  Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-86083

  n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

  +

  Affected < 1.123.76 and 2.0.0 to < 2.37.7 and 2.38.0 to < 2.38.2 Fixed 1.123.76 / 2.37.7 / 2.38.2 8 September 2026

  Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.2

  CVE-2026-85166

  n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow…

  +

  Affected < 2.35.4 and 2.36.0 to < 2.36.2 Fixed 2.35.4 / 2.36.2 3 September 2026

  A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-85168

  n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node

  +

  Affected < 1.123.73 and 2.0.0 to < 2.35.4 and 2.36.0 to < 2.36.2 Fixed 1.123.73 / 2.35.4 / 2.36.2 3 September 2026

  The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with local configuration setting one of those keys together with a matching attribute pattern causes git to execute the configured command during an ordinary Add, Commit, Checkout, or Pull operation. The command runs as the n8n process user.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-85169

  n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler

  +

  Affected < 1.123.73 and 2.0.0 to < 2.35.4 and 2.36.0 to < 2.36.2 Fixed 1.123.73 / 2.35.4 / 2.36.2 3 September 2026

  $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-85170

  n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to…

  +

  Affected < 1.123.73 and 2.0.0 to < 2.35.4 and 2.36.0 to < 2.36.2 Fixed 1.123.73 / 2.35.4 / 2.36.2 3 September 2026

  An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing the composer to read a local file accessible to the n8n process or fetch an internal URL (SSRF) and attach the result to the outgoing message.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-85171

  n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable…

  +

  Affected < 1.123.73 and 2.0.0 to < 2.35.4 and 2.36.0 to < 2.36.2 Fixed 1.123.73 / 2.35.4 / 2.36.2 3 September 2026

  These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-77068

  n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the…

  +

  Affected 2.33.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 2.33.4 / 2.34.1 20 August 2026

  The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.4

  CVE-2026-77072

  n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form…

  +

  Affected < 1.123.69 and 2.33.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. Any visitor who submitted the resulting public form would have that script execute same-origin with their session.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.4

  CVE-2026-77075

  n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection…

  +

  Affected < 1.123.69 and 2.33.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can store a malicious value so that when another user opens the affected node in the editor, the injected expression is evaluated as JavaScript in the victim's authenticated session (cross-user script execution).

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-77076

  n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the…

  +

  Affected < 1.123.69 and 2.33.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.6

  CVE-2026-77077

  n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape

  +

  Affected < 1.123.69 and 2.33.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-77079

  n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion…

  +

  Affected < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 2.33.4 / 2.34.1 20 August 2026

  When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-77080

  n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write…

  +

  Affected < 1.123.69 and 2.0.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  An authenticated user with usable Snowflake credentials can upload a local file from the n8n host or overwrite an existing file with a staged one.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-77084

  n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node

  +

  Affected < 1.123.69 and 2.0.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-77081

  n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the…

  +

  Affected < 1.123.69 and 2.0.0 to < 2.33.4 and 2.34.0 to < 2.34.1 Fixed 1.123.69 / 2.33.4 / 2.34.1 20 August 2026

  When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enforces the allowed-domains policy of only the first credential while still attaching material from both. An authenticated user with workflow-authoring rights can thereby send a domain-restricted credential to an attacker-controlled endpoint, exfiltrating it with the leaked credential's permissions.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.9

  CVE-2026-71539

  n8n is an open source workflow automation platform

  +

  Affected See advisory Fixed See advisory 18 August 2026

  Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-72749

  n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set)…

  +

  Affected < 1.123.67 and 2.31.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 1.123.67 / 2.31.5 / 2.32.1 11 August 2026

  The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.7

  CVE-2026-72762

  n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit…

  +

  Affected See advisory Fixed See advisory 11 August 2026

  An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.2

  CVE-2026-72763

  n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials…

  +

  Affected < 1.123.67 and 2.31.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 1.123.67 / 2.31.5 / 2.32.1 11 August 2026

  A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential's ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow's project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.2

  CVE-2026-72766

  n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in…

  +

  Affected < 1.123.67 and 2.0.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 1.123.67 / 2.31.5 / 2.32.1 11 August 2026

  A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.7

  CVE-2026-72767

  n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution…

  +

  Affected See advisory Fixed See advisory 11 August 2026

  Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-72770

  n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and…

  +

  Affected < 1.123.67 and 2.31.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 1.123.67 / 2.31.5 / 2.32.1 11 August 2026

  Attackers with workflow create/execute rights can point allowlisted remote configurations at local paths outside the sandbox to pull arbitrary git repositories and read their files and history.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-72771

  n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM…

  +

  Affected < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 2.31.5 / 2.32.1 11 August 2026

  Low-privileged workflow editors with use-only access to shared credentials can redirect requests to attacker-controlled hosts and exfiltrate credential secrets for reuse against underlying services.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.9

  CVE-2026-72772

  n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login…

  +

  Affected See advisory Fixed See advisory 11 August 2026

  When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-72774

  n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node

  +

  Affected See advisory Fixed See advisory 11 August 2026

  An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-72750

  n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's…

  +

  Affected < 1.123.67 and 2.0.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 1.123.67 / 2.31.5 / 2.32.1 11 August 2026

  When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.3

  CVE-2026-72768

  n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP…

  +

  Affected 2.31.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 2.31.5 / 2.32.1 11 August 2026

  Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection, exposing internal services and reading responses back through the workflow.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.7

  CVE-2026-72773

  n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use…

  +

  Affected < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 2.31.5 / 2.32.1 11 August 2026

  A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-72775

  n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node…

  +

  Affected < 1.123.67 and 2.31.0 to < 2.31.5 and 2.32.0 to < 2.32.1 Fixed 1.123.67 / 2.31.5 / 2.32.1 11 August 2026

  An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-65015

  n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

  +

  Affected < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 2.29.8 / 2.30.1 22 July 2026

  A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-65016

  n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

  +

  Affected < 1.123.64 and 2.0.0 to < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 1.123.64 / 2.29.8 / 2.30.1 22 July 2026

  The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.9

  CVE-2026-65591

  n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

  +

  Affected < 1.123.64 and 2.0.0 to < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 1.123.64 / 2.29.8 / 2.30.1 22 July 2026

  An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.4

  CVE-2026-65592

  n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

  +

  Affected < 1.123.64 and 2.0.0 to < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 1.123.64 / 2.29.8 / 2.30.1 22 July 2026

  An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.9

  CVE-2026-65595

  n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

  +

  Affected < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 2.29.8 / 2.30.1 22 July 2026

  On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.1

  CVE-2026-65596

  n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

  +

  Affected < 1.123.64 and 2.0.0 to < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 1.123.64 / 2.29.8 / 2.30.1 22 July 2026

  An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owner users are affected.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.2

  CVE-2026-65597

  n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

  +

  Affected < 1.123.64 and 2.0.0 to < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 1.123.64 / 2.29.8 / 2.30.1 22 July 2026

  A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.9

  CVE-2026-65598

  n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

  +

  Affected < 1.123.64 and 2.0.0 to < 2.29.8 and 2.30.0 to < 2.30.1 Fixed 1.123.64 / 2.29.8 / 2.30.1 22 July 2026

  This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-59206

  n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

  +

  Affected < 1.123.61 and 2.0.0 to < 2.27.4 and 2.28.0 to < 2.28.1 Fixed 1.123.61 / 2.27.4 / 2.28.1 9 July 2026

  Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-59207

  n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

  +

  Affected < 2.27.4 and 2.28.0 to < 2.28.1 Fixed 2.27.4 / 2.28.1 9 July 2026

  Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.6

  CVE-2026-59208

  n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

  +

  Affected < 2.27.4 and 2.28.0 to < 2.28.1 Fixed 2.27.4 / 2.28.1 9 July 2026

  Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2026-59209

  n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

  +

  Affected < 1.123.61 and 2.0.0 to < 2.27.4 and 2.28.0 to < 2.28.1 Fixed 1.123.61 / 2.27.4 / 2.28.1 9 July 2026

  Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.4

  CVE-2026-56776

  n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST…

  +

  Affected < 1.123.55 and 2.0.0 to < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 1.123.55 / 2.25.7 / 2.26.2 8 July 2026

  An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unintended outbound API calls, data mutations, or other side effects in connected downstream systems. The issue primarily affects instances using the Evaluations feature where RBAC project roles grant workflow:read without workflow:execute.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-59257

  n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

  +

  Affected < 1.123.61 and 2.0.0 to < 2.27.4 and 2.28.0 to < 2.28.1 Fixed 1.123.61 / 2.27.4 / 2.28.1 8 July 2026

  The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2025-71380

  The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system…

  +

  Affected See advisory Fixed See advisory 4 July 2026

  Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.7

  CVE-2026-56350

  n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable…

  +

  Affected < 2.8.0 Fixed 2.8.0 30 June 2026

  Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.7

  CVE-2026-54311

  n8n: Merge Node SQL Mode Prototype Pollution

  +

  Affected < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 2.25.7 / 2.26.2 23 June 2026

  Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow persist into subsequent Merge SQL executions belonging to other users or projects. This allowed a low-privileged attacker to intercept workflow data processed by other users on the same instance. This issue only affects multi-user n8n instances where more than one user has permission to create and execute workflows containing the Merge node in SQL Query mode. This vulnerability is fixed in 2.25.7 and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.5

  CVE-2026-54314

  n8n: Denial of Service via ZIP decompression in webhook workflow

  +

  Affected < 2.24.0 Fixed 2.24.0 23 June 2026

  Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.7

  CVE-2026-54304

  n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

  +

  Affected < 1.123.55 and 2.0.0 to < 2.25.7 and 2.26.0 to < 2.26.1 Fixed 1.123.55 / 2.25.7 / 2.26.1 16 June 2026

  Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 7.0

  CVE-2026-54302

  n8n: Stored XSS in Chat Trigger Node

  +

  Affected < 1.123.55 and 2.0.0 to < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 1.123.55 / 2.25.7 / 2.26.2 16 June 2026

  Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When a logged-in user visited the chat URL, the injected code executed in the n8n origin with that user's session privileges. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 8.5

  CVE-2026-54312

  n8n: Microsoft SQL Node Prototype Pollution

  +

  Affected < 2.24.0 Fixed 2.24.0 16 June 2026

  Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted. This vulnerability is fixed in 2.24.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 7.0

  CVE-2026-54301

  n8n: Same-Origin XSS in Respond to Webhook Node

  +

  Affected < 1.123.55 and 2.0.0 to < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 1.123.55 / 2.25.7 / 2.26.2 16 June 2026

  Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user's session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 7.2

  CVE-2026-54308

  n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes

  +

  Affected < 2.25.7 and 2.26.0 to < 2.26.2 Fixed 2.25.7 / 2.26.2 16 June 2026

  Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 7.4

  GHSA-hv7x-3x78-gx53

  n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint

  +

  Affected < 1.123.55 Fixed 1.123.55 16 June 2026

  ## Impact The `POST /workflows/{workflowId}/test-runs/new` endpoint authorized access using `workflow:read` rather than `workflow:execute`. An authenticated user with read-only access to a workflow could trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner. This could result in unintended outbound API calls, data mutations, or other side effects in downstream systems connected to the workflow. This issue primarily affects instances where the Evaluations feature is in use and where users may have `workflow:read` access without `workflow:execute` access, such as deployments using RBAC project roles. ## Patches The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow access to fully trusted users only. - Audit project role assignments and limit `workflow:read` access on sensitive workflows to users who should also be permitted to execute them. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 7.7

  CVE-2026-54313

  n8n: NoSQL Injection in MongoDB Node Find And Replace Operation

  +

  Affected < 2.24.0 Fixed 2.24.0 16 June 2026

  Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 7.7

  CVE-2026-49465

  n8n: Git Node Clone and Push Operations Bypass File Sandbox

  +

  Affected < 1.123.48 and 2.0.0 to < 2.21.8 and 2.22.0 to < 2.22.4 Fixed 1.123.48 / 2.21.8 / 2.22.4 16 June 2026

  Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8N_RESTRICT_FILE_ACCESS_TO file sandbox. This allowed the contents of any local git repository accessible to the n8n process to be cloned into an allowed path and read, circumventing the access restrictions that correctly blocked direct file reads to the same paths. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 8.5

  CVE-2026-49444

  n8n: Python sandbox escape

  +

  Affected < 1.123.48 and 2.0.0 to < 2.21.8 and 2.22.0 to < 2.22.4 Fixed 1.123.48 / 2.21.8 / 2.22.4 16 June 2026

  Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 8.3

  CVE-2026-45732

  n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints

  +

  Affected < 1.123.43 and 2.0.0 to < 2.20.7 and 2.21.0 to < 2.22.1 Fixed 1.123.43 / 2.20.7 / 2.22.1 14 May 2026

  Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow and overwrite the stored token material for that credential with tokens bound to an external account they control. Workflows relying on the affected credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of shared integrations. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 8.8

  CVE-2026-42229

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 4 May 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic implemented in the workflow. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.5

  CVE-2026-42226

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.33 and 2.17.0 to < 2.17.5 Fixed 1.123.33 / 2.17.5 29 April 2026

  Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authenticated caller was authorized to use a supplied credential reference. An authenticated user with access to a shared workflow could supply a foreign credential ID in the request body, causing the backend to decrypt and use that credential in a helper execution path where the caller also controls the destination URL. This allowed the caller to force the backend to authenticate against attacker-controlled infrastructure using a credential belonging to another user, effectively exfiltrating a reusable API key. The issue is not limited to any single node type; any node that resolves credentials dynamically through these endpoints may be affected. This issue has been patched in versions 1.123.33, 2.17.5, and 2.18.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 8.8

  CVE-2026-42234

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This issue only affects instances where the Python Task Runner is enabled. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 8.7

  CVE-2026-42236

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.5 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.5 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests and stored client data without adequate resource controls. An unauthenticated remote attacker could exhaust server memory resources by sending large registration payloads, rendering the n8n instance unavailable. The MCP enable/disable toggle gates MCP access but did not restrict client registrations, meaning the endpoint is reachable regardless of whether MCP access is enabled on the instance. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 8.8

  CVE-2026-42237

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node. Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping, enabling SQL injection against the connected database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• High 7.1

  CVE-2026-27496

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.22 and 2.0.0 to < 2.9.3 and 2.10.0 to < 2.10.1 Fixed 1.123.22 / 2.9.3 / 2.10.1 25 March 2026

  Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js process — including data from prior requests, tasks, secrets, or tokens — resulting in information disclosure of sensitive in-process data. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. In external runner mode, the impact is limited to data within the external runner process. The issue has been fixed in n8n versions 1.123.22, 2.10.1 , and 2.9.3. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or use external runner mode (`N8N_RUNNERS_MODE=external`) to isolate the runner process. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.5

  CVE-2026-33663

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.27 and 2.0.0 to < 2.13.3 and 2.14.0 to < 2.14.1 Fixed 1.123.27 / 2.13.3 / 2.14.1 25 March 2026

  Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with the `global:member` role could exploit chained authorization flaws in n8n's credential pipeline to steal plaintext secrets from generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `httpQueryAuth`) belonging to other users on the same instance. The attack abuses a name-based credential resolution path that does not enforce ownership or project scope, combined with a bypass in the credentials permission checker that causes generic HTTP credential types to be skipped during pre-execution validation. Together, these flaws allow a member-role user to resolve another user's credential ID and execute a workflow that decrypts and uses that credential without authorization. Native integration credential types (e.g. `slackApi`, `openAiApi`, `postgres`) are not affected by this issue. This vulnerability affects Community Edition only. Enterprise Edition has additional permission gates on workflow creation and execution that independently block this attack chain. The issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Restrict instance access to fully trusted users only, and/or audit credentials stored on the instance and rotate any generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `httpQueryAuth`) that may have been exposed. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-33665

  n8n is an open source workflow automation platform

  +

  Affected < 1.121.0 and 2.0.0 to < 2.4.0 Fixed 1.121.0 / 2.4.0 25 March 2026

  Prior to versions 2.4.0 and 1.121.0, when LDAP authentication is enabled, n8n automatically linked an LDAP identity to an existing local account if the LDAP email attribute matched the local account's email. An authenticated LDAP user who could control their own LDAP email attribute could set it to match another user's email — including an administrator's — and upon login gain full access to that account. The account linkage persisted even if the LDAP email was later reverted, resulting in a permanent account takeover. LDAP authentication must be configured and active (non-default). The issue has been fixed in n8n versions 2.4.0 and 1.121.0. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Disable LDAP authentication until the instance can be upgraded, restrict LDAP directory permissions so that users cannot modify their own email attributes, and/or audit existing LDAP-linked accounts for unexpected account associations. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.8

  CVE-2026-33713

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.26 and 2.0.0 to < 2.13.3 and 2.14.0 to < 2.14.1 Fixed 1.123.26 / 2.13.3 / 2.14.1 25 March 2026

  Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could exploit a SQL injection vulnerability in the Data Table Get node. On default SQLite DB, single statements can be manipulated and the attack surface is practically limited. On PostgreSQL deployments, multi-statement execution is possible, enabling data modification and deletion. The issue has been fixed in n8n versions 1.123.26, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, disable the Data Table node by adding `n8n-nodes-base.dataTable` to the `NODES_EXCLUDE` environment variable, and/or review existing workflows for Data Table Get nodes where `orderByColumn` is set to an expression that incorporates external or user-supplied input. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.3

  CVE-2026-33722

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.23 and 2.0.0 to < 2.6.4 Fixed 1.123.23 / 2.6.4 25 March 2026

  Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the `externalSecret:list` permission check and allowed access to secrets stored in connected vaults without admin or owner privileges. This issue requires the instance to have an external secrets vault configured. The attacker must know or be able to guess the name of a target secret. The issue has been fixed in n8n versions 1.123.23 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Restrict n8n access to fully trusted users only, and/or disable external secrets integration until the patch can be applied. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.4

  CVE-2026-33724

  n8n is an open source workflow automation platform

  +

  Affected < 2.5.0 Fixed 2.5.0 25 March 2026

  Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for git operations explicitly disabled host key verification. A network attacker positioned between the n8n instance and the remote Git server could intercept the connection and present a fraudulent host key, potentially injecting malicious content into workflows or intercepting repository data. This issue only affects instances where the Source Control feature has been explicitly enabled and configured to use SSH (non-default). The issue has been fixed in n8n version 2.5.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Disable the Source Control feature if it is not actively required, and/or restrict network access to ensure the n8n instance communicates with the Git server only over trusted, controlled network paths. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.5

  CVE-2026-27578

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.22 and 2.0.0 to < 2.9.3 and 2.10.0 to < 2.10.1 Fixed 1.123.22 / 2.9.3 / 2.10.1 25 February 2026

  Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different techniques on various nodes (Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node). Scripts injected by a malicious workflow execute in the browser of any user who visits the affected page, enabling session hijacking and account takeover. The issues have been fixed in n8n versions 2.10.1 and 1.123.21. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.7

  CVE-2025-61917

  n8n is an open source workflow automation platform

  +

  Affected 1.65.0 to < 1.114.3 Fixed 1.114.3 4 February 2026

  From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers could contain residual data from within the same Node.js process (for example, data from prior requests, tasks, secrets, or tokens), resulting in potential information disclosure. This issue has been patched in version 1.114.3.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.5

  CVE-2026-25051

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.2 Fixed 1.123.2 4 February 2026

  Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in version 1.123.2.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.5

  CVE-2026-25054

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.9 and 2.0.0 to < 2.2.1 Fixed 1.123.9 / 2.2.1 4 February 2026

  Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting (XSS) vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user with permission to create or modify workflows could abuse this to execute scripts with same-origin privileges when other users interact with a maliciously crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in versions 1.123.9 and 2.2.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 8.1

  CVE-2026-25055

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.12 and 2.0.0 to < 2.4.0 Fixed 1.123.12 / 2.4.0 4 February 2026

  Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those remote systems potentially leading to remote code execution on those systems. As a prerequisites an unauthenticated attacker needs knowledge of such workflows existing and the endpoints for file uploads need to be unauthenticated. This issue has been patched in versions 1.123.12 and 2.4.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.3

  CVE-2025-61914

  n8n is an open source workflow automation platform

  +

  Affected < 1.114.0 Fixed 1.114.0 26 December 2025

  Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window, rather than within the expected sandbox introduced in version 1.103.0. This behavior can enable a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. This issue has been patched in version 1.114.0. Workarounds for this issue involve restricting workflow creation and modification privileges to trusted users only, avoiding use of untrusted HTML responses in the “Respond to Webhook” node, and using an external reverse proxy or HTML sanitizer to filter responses that include executable scripts.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the National Vulnerability Database

• High 7.1

  CVE-2025-68697

  Arbitrary file read/write in the legacy JavaScript Code node

  +

  Authenticated Affected 1.2.1 to < 2.0.0 Fixed 2.0.0 Dec 2025

  The legacy JavaScript Code node allowed an authenticated user to read and write files on the host outside the intended scope. Resolved in the 2.0 line.

  Upgrade to 2.0.0 or later and move workflows off the legacy JavaScript Code node.

  Read the full advisory at Rapid7 research

• High 7.5

  CVE-2023-27564

  Information disclosure (exposure of resource to wrong sphere)

  +

  Unauthenticated Affected 0.218.0 Fixed Later 0.x release 10 May 2023

  An older issue showing the pattern is not new: this version exposed sensitive information to unauthorized callers over the network.

  Upgrade past 0.218.0 and don't expose the instance directly to the internet. Put it behind authentication or a private network.

  Read the full advisory at the National Vulnerability Database

• Medium 6.8

  CVE-2026-54303

  n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

  +

  Affected < 2.24.0 Fixed 2.24.0 16 June 2026

  Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. This vulnerability is fixed in 2.24.0.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database

• Medium 6.5

  CVE-2026-42227

  n8n is an open source workflow automation platform

  +

  Affected < 1.123.32 and 2.17.0 to < 2.17.4 and 2.18.0 to < 2.18.1 Fixed 1.123.32 / 2.17.4 / 2.18.1 29 April 2026

  Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with a valid API key scoped to variable:list could read variables from projects they are not a member of by supplying an arbitrary projectId query parameter to the public API variables endpoint. The handler queried the variables repository directly without enforcing project membership checks, bypassing the authorization-aware service layer used by the internal enterprise controller. If variables were misused to store sensitive information such as credentials or tokens, they should be rotated immediately. This issue only affects licensed enterprise or team deployments with multiple projects and the variables feature enabled. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

  Check the advisory for the fixed release and upgrade. Restrict who can edit workflows and keep the instance off the public internet until you have patched.

  Read the full advisory at the GitHub Advisory Database