N8n - vulnerabilities (CVEs)

230 CVEs in 4 products, 45 in the last 30 days, newest from 2026-10-28.

Products

• N8n - 230 CVEs
• Fastapi - 0 CVEs
• Pydantic - 0 CVEs
• Uvicorn - 0 CVEs

Newest CVEs of N8n

• CVE-2026-118679 - CVSS 7.5 (high), 2026-10-28: n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated…
• CVE-2026-118678 - CVSS 7.1 (high), 2026-10-28: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by…
• CVE-2026-118676 - CVSS 7.1 (high), 2026-10-28: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by…
• CVE-2026-118677 - CVSS 5.9 (medium), 2026-10-28: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect…
• CVE-2026-118675 - CVSS 7.1 (high), 2026-10-28: n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials…
• CVE-2026-118649 - CVSS 8.7 (high), 2026-10-28: n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted…
• CVE-2026-118648 - CVSS 8.4 (high), 2026-10-28: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths,…
• CVE-2026-118647 - CVSS 8.2 (high), 2026-10-28: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll…
• CVE-2026-118646 - CVSS 7.1 (high), 2026-10-28: n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event…
• CVE-2026-118645 - CVSS 8.7 (high), 2026-10-28: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where…
• CVE-2026-118644 - CVSS 7.7 (high), 2026-10-28: n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the…
• CVE-2026-118643 - CVSS 8.2 (high), 2026-10-28: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB…
• CVE-2026-118641 - CVSS 7.5 (high), 2026-10-28: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and…
• CVE-2026-118642 - CVSS 7.1 (high), 2026-10-28: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials…
• CVE-2026-118640 - CVSS 5.4 (medium), 2026-10-28: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool…
• CVE-2026-110853 - CVSS 7.1 (high), 2026-10-14: n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted…
• CVE-2026-110852 - CVSS 6.3 (medium), 2026-10-14: n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on…
• CVE-2026-110851 - CVSS 6.1 (medium), 2026-10-14: n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks…
• CVE-2026-110850 - CVSS 7.2 (high), 2026-10-14: n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because…
• CVE-2026-110849 - CVSS 7.2 (high), 2026-10-14: n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an…
• CVE-2026-110848 - CVSS 6 (medium), 2026-10-14: n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges…
• CVE-2026-110847 - CVSS 7 (high), 2026-10-14: n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page,…
• CVE-2026-110846 - CVSS 7 (high), 2026-10-14: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before…
• CVE-2026-110845 - CVSS 7.7 (high), 2026-10-14: n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a…
• CVE-2026-110844 - CVSS 7.2 (high), 2026-10-14: n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them…
• CVE-2026-110843 - CVSS 8.2 (high), 2026-10-14: n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which…
• CVE-2026-110842 - CVSS 7.7 (high), 2026-10-14: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates…
• CVE-2026-110841 - CVSS 6.1 (medium), 2026-10-14: n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without…
• CVE-2026-110840 - CVSS 7 (high), 2026-10-14: n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field…
• CVE-2026-103260 - CVSS 6.3 (medium), 2026-10-01: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers…