N8n-io vulnerabilities
206 CVEs and advisories name N8n-io as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-65016n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role
- CVE-2026-65015n8n before 2.30.1 Privilege Escalation via run_node_tool
- CVE-2026-65014n8n before 2.28.0 Authentication Bypass via test-webhook
- CVE-2026-59209n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
- CVE-2026-59206n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
- CVE-2026-59208n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
- CVE-2026-59207n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
- CVE-2026-44792n8n: Source Control Pull SQL Injection
- CVE-2026-44791n8n: XML Node Prototype Pollution Patch Bypass
- CVE-2026-44790n8n: Arbitrary File Read via Git Node
- CVE-2026-44789n8n: HTTP Request Node Pagination Prototype Pollution to RCE
- CVE-2026-45732n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
- CVE-2026-49444n8n: Python sandbox escape
- CVE-2026-49465n8n: Git Node Clone and Push Operations Bypass File Sandbox
- CVE-2026-54304n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
- CVE-2026-54307n8n: Credential Exfiltration via Permission Bypass
- CVE-2026-54302n8n: Stored XSS in Chat Trigger Node
- CVE-2026-54305n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
- CVE-2026-54301n8n: Same-Origin XSS in Respond to Webhook Node
- CVE-2026-54306n8n: Prototype Pollution enables confused-deputy execution via public webhooks
- CVE-2026-54308n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node
- CVE-2026-54311n8n: Merge Node SQL Mode Prototype Pollution
- CVE-2026-54310n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
- CVE-2026-54309n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
- CVE-2026-54314n8n: Denial of Service via ZIP decompression in webhook workflow
- CVE-2026-54312n8n: Microsoft SQL Node Prototype Pollution
- CVE-2026-54303n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
- CVE-2026-54313n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
- CVE-2026-42237n8n: SQL Injection in Snowflake and MySQL Nodes
- CVE-2026-42236n8n: Unauthenticated Denial of Service via MCP Client Registration