Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

n8n — Vulnerabilities & Security Advisories 228

All 228 CVE vulnerabilities found in n8n, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with n8n, a popular workflow automation platform. It focuses on weakness types typically categorized under Common Weakness Enumerations relevant to software applications and integration tools. The content collected here includes publicly disclosed vulnerabilities affecting various versions of the n8n product. The time range covered spans from the initial release of the software up to the most recent updates, ensuring a comprehensive historical view of security issues. This includes vulnerabilities that were reported, patched, or remain unresolved in specific deployments. The data is sourced from vendor advisories, open-source security databases, and community disclosures. Visitors to this page can track the vendor's security advisories to understand the response timeline and mitigation strategies for identified issues. Users can also gain a deeper understanding of specific weakness classes by examining the patterns and frequencies of reported bugs within the n8n ecosystem. Additionally, the page allows for looking up a product's vulnerability history, providing insights into the overall security posture and development practices of n8n over time. This resource is designed for security researchers, system administrators, and developers who need to assess risks associated with using or integrating n8n into their workflows. By consolidating this information, the page serves as a central reference for evaluating the stability and security of the automation platform.

Vendor: n8n-io

CVE ID Title CVSS Severity Published
CVE-2026-119557 n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node CWE-22 5.9 Medium 2026-10-30
CVE-2026-119408 n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes CWE-653 8.8 High 2026-10-30
CVE-2026-118679 n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger CWE-918 7.5 High 2026-10-28
CVE-2026-118677 n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance CWE-939 5.9 Medium 2026-10-28
CVE-2026-118678 n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction CWE-1321 7.1 High 2026-10-28
CVE-2026-118676 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass CWE-863 7.1 High 2026-10-28
CVE-2026-118649 n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables CWE-1321 8.3 High 2026-10-28
CVE-2026-118675 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow CWE-863 7.1 High 2026-10-28
CVE-2026-118648 n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy CWE-79 7.3 High 2026-10-28
CVE-2026-118647 n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data CWE-532 8.2 High 2026-10-28
CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node CWE-1333 6.5 Medium 2026-10-28
CVE-2026-118645 n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter CWE-943 8.7 High 2026-10-28
CVE-2026-118644 n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance CWE-266 7.7 High 2026-10-28
CVE-2026-118643 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data CWE-209 8.2 High 2026-10-28
CVE-2026-118642 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows CWE-863 7.1 High 2026-10-28
CVE-2026-118641 n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes CWE-943 7.5 High 2026-10-28
CVE-2026-118640 n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass CWE-863 5.4 Medium 2026-10-28
CVE-2026-110853 n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON CWE-639 7.1 High 2026-10-14
CVE-2026-110852 n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution CWE-288 6.3 Medium 2026-10-14
CVE-2026-110851 n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint CWE-639 6.1 Medium 2026-10-14
CVE-2026-110850 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters CWE-863 7.2 High 2026-10-14
CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview CWE-79 7.2 High 2026-10-14
CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge CWE-1321 6.0 Medium 2026-10-14
CVE-2026-110847 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter CWE-79 7.0 High 2026-10-14
CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook CWE-180 7.0 High 2026-10-14
CVE-2026-110845 n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation CWE-15 7.7 High 2026-10-14
CVE-2026-110844 n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows CWE-863 7.2 High 2026-10-14
CVE-2026-110843 n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint CWE-770 8.2 High 2026-10-14
CVE-2026-110842 n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter CWE-1321 7.7 High 2026-10-14
CVE-2026-110840 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field CWE-89 7.0 High 2026-10-14

All 228 known CVE vulnerabilities affecting n8n with full Chinese analysis, references, and POCs where available.