Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 246

Export CSV
CVE-2026-110844

n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows

n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-110852

n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-110847

n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-110842

n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103258

n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103254

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103250

n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103246

n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103259

n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103255

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103251

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103247

n8n before 1.123.80 Credential Tampering via Duplicate Node IDs

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103253

n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103245

n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103257

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103249

n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103260

n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103256

n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103252

n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-103248

n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n