Advisoriesby Ibis
n8n security advisories
156 advisories · 77 critical or high in 12 months · latest Sep 10
60 of 156 advisories
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource SubstitutionCVE-2026-86073fixed in 2.37.7 +1n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched ContentCVE-2026-86074fixed in 2.37.7 +1n8n: path traversalCVE-2026-86995fixed in 1.123.76 +2n8n: missing authorizationCVE-2026-86085fixed in 2.37.7 +1n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership CheckCVE-2026-86993fixed in 1.123.76 +2n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid SessionsCVE-2026-86084fixed in 1.123.76 +2n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-OpenCVE-2026-86080fixed in 1.123.76 +2n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded IdentifiersCVE-2026-86079fixed in 1.123.76 +2n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of ServiceCVE-2026-86078fixed in 2.37.7 +1n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId FilterCVE-2026-86994fixed in 1.123.76 +2n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code ExecutionCVE-2026-86083fixed in 1.123.76 +2n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocketCVE-2026-86077fixed in 2.37.7 +1n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model NodeCVE-2026-86082fixed in 1.123.76 +2n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone PathCVE-2026-86081fixed in 1.123.76 +2n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration EndpointCVE-2026-86075fixed in 2.37.7 +1n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code ExecutionCVE-2026-86076fixed in 1.123.76 +2n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller PolicyCVE-2026-86996fixed in 2.37.7 +1n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression InterpolationCVE-2026-72750fixed in 1.123.67 +2n8n: SQL injectionCVE-2026-72775fixed in 1.123.67 +2n8n: Cross-Tenant Module-Cache Poisoning in the JS Task RunnerCVE-2026-72764fixed in 1.123.67 +2n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution DataCVE-2026-65589fixed in 1.123.64 +2n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test WebhookCVE-2026-65014fixed in 2.27.4n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" RestrictionCVE-2026-65596fixed in 1.123.64 +2n8n: improper authorizationCVE-2026-65594fixed in 2.29.8 +1n8n: computer-use Shell Sandbox Not Enforced on Linux and WindowsCVE-2026-65590fixed in 2.29.8 +1n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File UploadsCVE-2026-58661fixed in 1.123.58 +1n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other ProjectsCVE-2026-59253fixed in 2.28.0n8n: External Secrets Accessible via Workflow Expressions Outside CredentialsCVE-2026-59254fixed in 2.27.4 +1n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression InterpolationCVE-2026-59257fixed in 1.123.61 +2n8n: External Secrets Permission Bypass via Expression Parser MismatchCVE-2026-59259fixed in 1.123.61 +2n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base DirectoryCVE-2026-72773fixed in 2.31.5 +1n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of ServiceCVE-2026-72769fixed in 1.123.67 +2n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of ServiceCVE-2026-72749fixed in 1.123.67 +2n8n: Edit Image Node Format Injection Allows Arbitrary File WriteCVE-2026-72762fixed in 1.123.67 +2n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSONCVE-2026-72763fixed in 1.123.67 +2n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`CVE-2026-72774fixed in 1.123.67 +2n8n: Expression sandbox escape via arrow-function bodies enabling command executionCVE-2026-72765fixed in 2.31.5 +1n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type ConfusionCVE-2026-72766fixed in 1.123.67 +2n8n: Authenticated code execution in the n8n Git nodeCVE-2026-72767fixed in 1.123.67 +2n8n: SSRF Protection Bypass via MCP Client NodeCVE-2026-72768fixed in 2.31.5 +1n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path RestrictionCVE-2026-72770fixed in 1.123.67 +2n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM NodesCVE-2026-72771fixed in 2.31.5 +1n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed LoginCVE-2026-72772fixed in 2.31.5 +1n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance OwnerCVE-2026-65016fixed in 1.123.64 +2n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code ExecutionCVE-2026-65591fixed in 1.123.64 +2n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network AccessCVE-2026-65593fixed in 1.123.64 +2n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTsCVE-2026-65595fixed in 2.29.8 +1n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity ResolutionCVE-2026-59208fixed in 2.27.4 +1n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP ConnectorCVE-2026-59207fixed in 2.27.4 +1n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project EnumerationCVE-2026-59206fixed in 1.123.61 +2n8n: Shared Credential Header Leak via HTTP Request Pagination ExpressionCVE-2026-59209fixed in 1.123.61 +2n8n: Google Service Account Private Key Exposed in JWT HeaderCVE-2026-65599fixed in 1.123.64 +2n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`CVE-2026-65592fixed in 1.123.64 +2n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML PreviewCVE-2026-65597fixed in 1.123.64 +2n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code ExecutionCVE-2026-65598fixed in 1.123.64 +2n8n: AI Agents Project Viewer Privilege Escalation via run_node_toolCVE-2026-65015fixed in 2.29.8 +1n8n: Wrong OAuth Scope on Evaluation Test Runs EndpointsCVE-2026-56775fixed in 1.123.55 +2n8n: SecurityScorecard Node Leaks API Token to User-Controlled HostCVE-2026-54304fixed in 1.123.55 +2n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control SessionsCVE-2026-54309fixed in 2.25.7 +1n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE EndpointsCVE-2026-54305fixed in 1.123.55 +2