[ Vendor · 31 CVEs ]
n8n-io
CVEs affecting n8n-io published in the last 30 days, plus any n8n-io CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110851 | 14 Oct 2026 | CVSS 6.1 | n8n-io n8nn8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID… | |
| CVE-2026-110852 | 14 Oct 2026 | CVSS 6.3 | n8n-io n8nn8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched… | |
| CVE-2026-110853 | 14 Oct 2026 | CVSS 7.1 | n8n-io n8nn8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a… | |
| CVE-2026-110845 | 14 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails… | |
| CVE-2026-110846 | 14 Oct 2026 | CVSS 7.0 | n8n-io n8nn8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before… | |
| CVE-2026-110847 | 14 Oct 2026 | CVSS 7.0 | n8n-io n8nn8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat… | |
| CVE-2026-110848 | 14 Oct 2026 | CVSS 6.0 | n8n-io n8nn8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which… | |
| CVE-2026-110849 | 14 Oct 2026 | CVSS 7.2 | n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary… | |
| CVE-2026-110850 | 14 Oct 2026 | CVSS 7.2 | n8n-io n8nn8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow… | |
| CVE-2026-110840 | 14 Oct 2026 | CVSS 7.0 | n8n-io n8nn8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query… | |
| CVE-2026-110841 | 14 Oct 2026 | CVSS 6.1 | n8n-io n8nn8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body… | |
| CVE-2026-110842 | 14 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter… | |
| CVE-2026-110843 | 14 Oct 2026 | CVSS 8.2 | n8n-io n8nn8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize… | |
| CVE-2026-110844 | 14 Oct 2026 | CVSS 7.2 | n8n-io n8nn8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by… | |
| CVE-2026-103257 | 1 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that… | |
| CVE-2026-103258 | 1 Oct 2026 | CVSS 6.8 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and… | |
| CVE-2026-103259 | 1 Oct 2026 | CVSS 7.6 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke… | |
| CVE-2026-103260 | 1 Oct 2026 | CVSS 4.0 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode… | |
| CVE-2026-103252 | 1 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential… | |
| CVE-2026-103253 | 1 Oct 2026 | CVSS 8.7 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database… | |
| CVE-2026-103254 | 1 Oct 2026 | CVSS 6.3 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL… | |
| CVE-2026-103255 | 1 Oct 2026 | CVSS 9.0 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node… | |
| CVE-2026-103256 | 1 Oct 2026 | CVSS 7.1 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password… | |
| CVE-2026-103247 | 1 Oct 2026 | CVSS 8.5 | n8n-io n8nn8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard… | |
| CVE-2026-103248 | 1 Oct 2026 | CVSS 9.0 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's… | |
| CVE-2026-103249 | 1 Oct 2026 | CVSS 7.6 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in… | |
| CVE-2026-103250 | 1 Oct 2026 | CVSS 8.1 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat… | |
| CVE-2026-103251 | 1 Oct 2026 | CVSS 7.1 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community… | |
| CVE-2026-103245 | 1 Oct 2026 | CVSS 5.3 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow… | |
| CVE-2026-103246 | 1 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can… | |
| CVE-2025-68613 | 19 Dec 2025 | CVSS 8.8 | n8n Improper Control of Dynamically-Managed Code Resourcesn8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical… | ExploitedFix |