N8n-io vulnerabilities
206 CVEs and advisories name N8n-io as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-77069n8n before 1.123.69 SSRF Protection Bypass via OAuth2
- CVE-2026-77068n8n before 2.34.1 Remote Code Execution via Path Traversal
- CVE-2026-71539n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
- CVE-2026-72775n8n before 1.123.67 SQL Injection via PostgresTrigger Node
- CVE-2026-72774n8n before 1.123.67 Authentication Bypass via HTTP Request Node
- CVE-2026-72773n8n before 2.32.1 Path Traversal via computer-use search_files
- CVE-2026-72772n8n before 2.32.1 Authentication Bypass via Token Exchange
- CVE-2026-72771n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes
- CVE-2026-72770n8n before 1.123.67 Path Traversal via Git Node Operations
- CVE-2026-72769n8n before 1.123.67 Prototype Pollution via VM Expression Engine
- CVE-2026-72768n8n before 2.32.1 SSRF Protection Bypass via MCP Client
- CVE-2026-72767n8n before 1.123.67 Remote Code Execution via Git node
- CVE-2026-72766n8n before 1.123.67 Arbitrary File Read via Send Email Node
- CVE-2026-72765n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape
- CVE-2026-72764n8n before 1.123.67 Module Cache Poisoning via Code Node
- CVE-2026-72763n8n before 1.123.67 Credential Exfiltration via Sub-Workflow
- CVE-2026-72762n8n before 1.123.67 Arbitrary File Write via Edit Image Node
- CVE-2026-72750n8n before 1.123.67 SQL Injection via executeQuery Operation
- CVE-2026-72749n8n before 1.123.67 Prototype Pollution via Edit Fields
- CVE-2026-65599n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header
- CVE-2026-65598n8n before 1.123.64 Remote Code Execution via Git Clone
- CVE-2026-65597n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
- CVE-2026-65596n8n before 1.123.64 Credential Exfiltration via GraphQL Node
- CVE-2026-65595n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange
- CVE-2026-65594n8n before 2.30.1 Missing OAuth Authorization Check
- CVE-2026-65593n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters
- CVE-2026-65592n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
- CVE-2026-65591n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
- CVE-2026-65590n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
- CVE-2026-65589n8n before 1.123.64 Credential Exposure via LLM Node Execution Data