N8n-io vulnerabilities
206 CVEs and advisories name N8n-io as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-110840n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
- CVE-2026-103260n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
- CVE-2026-103259n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
- CVE-2026-103258n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
- CVE-2026-103257n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
- CVE-2026-103256n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
- CVE-2026-103255n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
- CVE-2026-103254n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
- CVE-2026-103253n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
- CVE-2026-103252n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
- CVE-2026-103251n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
- CVE-2026-103250n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
- CVE-2026-103249n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
- CVE-2026-103248n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
- CVE-2026-103247n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
- CVE-2026-103246n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
- CVE-2026-103245n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
- CVE-2026-92588n8n before 1.123.76 Improper Authorization via Source Control Push
- CVE-2026-92587n8n before 1.123.76 Sandbox Escape via Git Relative URL
- CVE-2026-86075n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
- CVE-2026-86076n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
- CVE-2026-86077n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
- CVE-2026-86078n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
- CVE-2026-86079n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
- CVE-2026-86080n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
- CVE-2026-86081n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
- CVE-2026-86082n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
- CVE-2026-86083n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
- CVE-2026-86084n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
- CVE-2026-86085n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints