Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

n8n — Vulnerabilities & Security Advisories 228

All 228 CVE vulnerabilities found in n8n, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with n8n, a popular workflow automation platform. It focuses on weakness types typically categorized under Common Weakness Enumerations relevant to software applications and integration tools. The content collected here includes publicly disclosed vulnerabilities affecting various versions of the n8n product. The time range covered spans from the initial release of the software up to the most recent updates, ensuring a comprehensive historical view of security issues. This includes vulnerabilities that were reported, patched, or remain unresolved in specific deployments. The data is sourced from vendor advisories, open-source security databases, and community disclosures. Visitors to this page can track the vendor's security advisories to understand the response timeline and mitigation strategies for identified issues. Users can also gain a deeper understanding of specific weakness classes by examining the patterns and frequencies of reported bugs within the n8n ecosystem. Additionally, the page allows for looking up a product's vulnerability history, providing insights into the overall security posture and development practices of n8n over time. This resource is designed for security researchers, system administrators, and developers who need to assess risks associated with using or integrating n8n into their workflows. By consolidating this information, the page serves as a central reference for evaluating the stability and security of the automation platform.

Vendor: n8n-io

CVE ID Title CVSS Severity Published
CVE-2026-110841 n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval CWE-639 6.1 Medium 2026-10-14
CVE-2026-103260 n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node CWE-862 4.0 Medium 2026-10-01
CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials CWE-863 7.6 High 2026-10-01
CVE-2026-103258 n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation CWE-943 6.8 Medium 2026-10-01
CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook CWE-522 7.1 High 2026-10-01
CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node CWE-22 7.7 High 2026-10-01
CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase CWE-73 9.0 Critical 2026-10-01
CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation CWE-22 6.3 Medium 2026-10-01
CVE-2026-103253 n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table CWE-89 8.7 High 2026-10-01
CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint CWE-639 7.7 High 2026-10-01
CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub CWE-862 7.1 High 2026-10-01
CVE-2026-103249 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator CWE-79 7.6 High 2026-10-01
CVE-2026-103250 n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory CWE-943 8.1 High 2026-10-01
CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase CWE-89 9.0 Critical 2026-10-01
CVE-2026-103247 n8n before 1.123.80 Credential Tampering via Duplicate Node IDs CWE-639 8.5 High 2026-10-01
CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification CWE-347 5.3 Medium 2026-10-01
CVE-2026-103246 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection CWE-639 7.7 High 2026-10-01
CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL CWE-426 5.0 Medium 2026-09-16
CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push CWE-639 4.4 Medium 2026-09-16
CVE-2026-86075 n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint CWE-770 8.7 High 2026-09-08
CVE-2026-86076 n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution CWE-94 8.7 High 2026-09-08
CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket CWE-862 6.3 Medium 2026-09-08
CVE-2026-86078 n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service CWE-1321 6.0 Medium 2026-09-08
CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers CWE-22 6.3 Medium 2026-09-08
CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open CWE-347 6.3 Medium 2026-09-08
CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path CWE-1333 7.1 High 2026-09-08
CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node CWE-918 7.1 High 2026-09-08
CVE-2026-86083 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution CWE-94 7.7 High 2026-09-08
CVE-2026-86084 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions CWE-288 6.0 Medium 2026-09-08
CVE-2026-86085 n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints CWE-862 5.1 Medium 2026-09-08

All 228 known CVE vulnerabilities affecting n8n with full Chinese analysis, references, and POCs where available.