Vulnerabilities in n8n-io
206 resultsCVE-2026-72774HIGHn8n before 1.123.67 Authentication Bypass via HTTP Request NodeEPSS 0.4%CVE-2026-86077MEDIUMn8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocketEPSS 0.4%CVE-2026-33713HIGHn8n Vulnerable to SQL Injection in Data Table Node via orderByColumn ExpressionEPSS 0.4%CVE-2026-103257HIGHn8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n NodeEPSS 0.4%CVE-2026-86082HIGHn8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model NodeEPSS 0.4%CVE-2026-27494HIGHn8n has Arbitrary File Read via Python Code Node Sandbox EscapeEPSS 0.4%CVE-2026-86995MEDIUMn8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository ReadEPSS 0.4%CVE-2026-59209HIGHn8n: Shared Credential Header Leak via HTTP Request Pagination ExpressionEPSS 0.4%CVE-2026-85170HIGHn8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodesEPSS 0.4%CVE-2026-33663HIGHn8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community EditionEPSS 0.4%CVE-2026-85167MEDIUMn8n before 2.36.2 Query Injection via Elasticsearch Firestore NodesEPSS 0.4%CVE-2026-72768MEDIUMn8n before 2.32.1 SSRF Protection Bypass via MCP ClientEPSS 0.4%CVE-2025-61917HIGHn8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task RunnerEPSS 0.4%CVE-2026-54312HIGHn8n: Microsoft SQL Node Prototype PollutionEPSS 0.4%CVE-2025-52478HIGHStored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/sourceEPSS 0.4%CVE-2026-54311MEDIUMn8n: Merge Node SQL Mode Prototype PollutionEPSS 0.4%CVE-2026-86073MEDIUMn8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource SubstitutionEPSS 0.4%CVE-2026-44792HIGHn8n: Source Control Pull SQL InjectionEPSS 0.4%CVE-2026-54307HIGHn8n: Credential Exfiltration via Permission BypassEPSS 0.4%CVE-2026-49444HIGHn8n: Python sandbox escapeEPSS 0.4%