Advisories · Technology
n8n.
Every CVE that names n8n among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node
- n8n
- Path traversal
- CVSS 8.7 High
n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
- n8n
- CWE-653
- CVSS 6.9 Medium
n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
- n8n
- Server-side request forgery (SSRF)
- CVSS 7.1 High
n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
- n8n
- Prototype pollution
- CVSS 5.9 Medium
n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
- n8n
- CWE-939
- CVSS 5.1 Medium
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
- n8n
- Broken access control
- CVSS 5.1 Medium
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
- n8n
- Broken access control
- CVSS 8.7 High
n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
- n8n
- Prototype pollution
- CVSS 8.4 High
n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
- n8n
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
- n8n
- Information disclosure
- CVSS 7.1 High
n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
- n8n
- Denial of service
- CVSS 7.0 High
n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
- n8n
- Other injection
- CVSS 5.1 Medium
n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
- n8n
- Privilege escalation
- CVSS 5.3 Medium
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data
- n8n
- Information disclosure
- CVSS 5.1 Medium
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
- n8n
- Broken access control
- CVSS 6.9 Medium
n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
- n8n
- Other injection
- CVSS 5.3 Medium
n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
- n8n
- Broken access control
- CVSS 7.1 High
n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
- n8n
- Broken access control
- CVSS 6.3 Medium
n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
- n8n
- Authentication bypass
- CVSS 6.1 Medium
n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
- n8n
- Broken access control
- CVSS 7.2 High
n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
- n8n
- Broken access control
- CVSS 7.2 High
n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
- n8n
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
- n8n
- Prototype pollution
- CVSS 7.0 High
n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter
- n8n
- Cross-site scripting (XSS)
- CVSS 7.0 High
n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
- n8n
- CWE-180
- CVSS 7.7 High
n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
- n8n
- CWE-15
- CVSS 7.2 High
n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
- n8n
- Broken access control
- CVSS 8.2 High
n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
- n8n
- Denial of service
- CVSS 7.7 High
n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter
- n8n
- Prototype pollution
- CVSS 6.1 Medium
n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
- n8n
- Broken access control
- CVSS 7.0 High
n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
- n8n
- SQL injection
- CVSS 6.3 Medium
n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
- n8n
- Broken access control
- CVSS 8.5 High
n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
- n8n
- Broken access control
- CVSS 6.9 Medium
n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
- n8n
- Other injection
- CVSS 8.1 High
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
- n8n
- Path traversal
- CVSS 7.1 High
n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
- n8n
- Hard-coded credentials
- CVSS 7.1 High
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
- n8n
- Path traversal
- CVSS 7.0 High
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
- n8n
- Path traversal
- CVSS 7.0 High
n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
- n8n
- SQL injection
- CVSS 7.1 High
n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
- n8n
- Broken access control
- CVSS 7.5 High
n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
- n8n
- Broken access control
- CVSS 7.0 High
n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
- n8n
- Other injection
- CVSS 6.9 Medium
n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
- n8n
- Cross-site scripting (XSS)
- CVSS 7.1 High
n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
- n8n
- SQL injection
- CVSS 5.8 Medium
n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
- n8n
- Broken access control
- CVSS 8.3 High
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
- n8n
- Broken access control
- CVSS 6.9 Medium
n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
- n8n
- Weak cryptography or TLS
- CVSS 5.9 Medium
n8n before 1.123.76 Improper Authorization via Source Control Push
- n8n
- Broken access control
- CVSS 5.3 Medium
n8n before 1.123.76 Sandbox Escape via Git Relative URL
- n8n
- CWE-426
- CVSS 5.3 Medium
n8n before 2.36.2 Missing Authorization via Insights API
- n8n
- Broken access control
- CVSS 5.3 Medium
n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
- n8n
- Server-side request forgery (SSRF)
- CVSS 7.1 High
n8n before 1.123.73 Credential Exposure via Error Logging
- n8n
- Information disclosure
- CVSS 7.1 High
n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
- n8n
- CWE-20
- CVSS 8.7 High
n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
- n8n
- Code injection
- CVSS 7.7 High
n8n before 1.123.73 Remote Code Execution via Git Node
- n8n
- Command injection
- CVSS 6.3 Medium
n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
- n8n
- Other injection
- CVSS 7.2 High
n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
- n8n
- Broken access control
- CVSS 7.2 High
n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
- n8n
- Code injection
- CVSS 6.3 Medium
n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
- n8n
- Server-side request forgery (SSRF)
- CVSS 7.7 High
n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values
- n8n
- Command injection