Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

n8n — Vulnerabilities & Security Advisories 228

All 228 CVE vulnerabilities found in n8n, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with n8n, a popular workflow automation platform. It focuses on weakness types typically categorized under Common Weakness Enumerations relevant to software applications and integration tools. The content collected here includes publicly disclosed vulnerabilities affecting various versions of the n8n product. The time range covered spans from the initial release of the software up to the most recent updates, ensuring a comprehensive historical view of security issues. This includes vulnerabilities that were reported, patched, or remain unresolved in specific deployments. The data is sourced from vendor advisories, open-source security databases, and community disclosures. Visitors to this page can track the vendor's security advisories to understand the response timeline and mitigation strategies for identified issues. Users can also gain a deeper understanding of specific weakness classes by examining the patterns and frequencies of reported bugs within the n8n ecosystem. Additionally, the page allows for looking up a product's vulnerability history, providing insights into the overall security posture and development practices of n8n over time. This resource is designed for security researchers, system administrators, and developers who need to assess risks associated with using or integrating n8n into their workflows. By consolidating this information, the page serves as a central reference for evaluating the stability and security of the automation platform.

Vendor: n8n-io

CVE ID Title CVSS Severity Published
CVE-2026-42227 n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure CWE-639 6.5 - 2026-05-04
CVE-2026-42226 n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay CWE-862 8.8 - 2026-05-04
CVE-2026-33751 n8n Vulnerable to LDAP Filter Injection in LDAP Node CWE-90 8.2 - 2026-03-25
CVE-2026-33749 n8n Vulnerable to XSS via Binary Data Inline HTML Rendering CWE-79 4.6 - 2026-03-25
CVE-2026-33724 n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no CWE-639 6.5 - 2026-03-25
CVE-2026-33722 n8n Has External Secrets Authorization Bypass in Credential Saving CWE-863 5.3 - 2026-03-25
CVE-2026-33720 n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK CWE-863 5.4 - 2026-03-25
CVE-2026-33713 n8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expression CWE-89 8.8 - 2026-03-25
CVE-2026-33696 n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE CWE-1321 8.8 - 2026-03-25
CVE-2026-33665 n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover CWE-287 8.5 - 2026-03-25
CVE-2026-33663 n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition CWE-639 6.5 - 2026-03-25
CVE-2026-33660 n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CWE-94 8.8 - 2026-03-25
CVE-2026-27496 n8n has In-Process Memory Disclosure in its Task Runner CWE-908 6.5 - 2026-03-25
CVE-2026-27498 n8n has Arbitrary Command Execution via File Write and Git Operations CWE-94 8.8AI High AI 2026-02-25
CVE-2026-27578 n8n Vulnerable to Stored XSS via Various Nodes CWE-80 5.4AI Medium AI 2026-02-25
CVE-2026-27577 n8n: Expression Sandbox Escape Leads to RCE CWE-94 9.4 Critical 2026-02-25
CVE-2026-27497 n8n has Potential Remote Code Execution via Merge Node CWE-94 8.8AI High AI 2026-02-25
CVE-2026-27495 n8n has a Sandbox Escape in its JavaScript Task Runner CWE-94 8.5AI High AI 2026-02-25
CVE-2026-27494 n8n has Arbitrary File Read via Python Code Node Sandbox Escape CWE-497 9.9AI Critical AI 2026-02-25
CVE-2026-27493 n8n has Unauthenticated Expression Evaluation via Form Node CWE-94 9.8AI Critical AI 2026-02-25
CVE-2026-25631 Domain allowlist bypass enables credential exfiltration CWE-20 6.5AI Medium AI 2026-02-06
CVE-2026-21893 n8n Vulnerable to Command Injection in Community Package Installation CWE-78 7.2AI High AI 2026-02-04
CVE-2026-25115 n8n is vulnerable to Python sandbox escape CWE-693 9.9AI Critical AI 2026-02-04
CVE-2026-25056 n8n Arbitrary File Write leading to RCE in n8n Merge Node CWE-434 8.8AI High AI 2026-02-04
CVE-2026-25055 n8n Arbitrary File Write on Remote Systems via SSH Node CWE-22 10.0AI Critical AI 2026-02-04
CVE-2026-25054 n8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI CWE-80 5.4AI Medium AI 2026-02-04
CVE-2026-25053 n8n is Vulnerable to OS Command Injection in Git Node CWE-78 8.8AI High AI 2026-02-04
CVE-2026-25052 n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users CWE-367 8.8AI High AI 2026-02-04
CVE-2026-25051 n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS CWE-79 5.4AI Medium AI 2026-02-04
CVE-2025-61917 n8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner CWE-668 7.7 High 2026-02-04

All 228 known CVE vulnerabilities affecting n8n with full Chinese analysis, references, and POCs where available.