Vulnerabilities in n8n-io
206 resultsCVE-2026-42229MEDIUMn8n: SQL Injection in SeaTable NodeEPSS 0.3%CVE-2026-86994MEDIUMn8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId FilterEPSS 0.3%CVE-2026-110845HIGHn8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log OperationEPSS 0.3%CVE-2026-65598HIGHn8n before 1.123.64 Remote Code Execution via Git CloneEPSS 0.3%CVE-2026-33665HIGHn8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account TakeoverEPSS 0.3%CVE-2026-42235HIGHn8n: XSS via MCP OAuth clientEPSS 0.3%CVE-2026-25052CRITICALn8n Improper File Access Controls Allow Arbitrary File Read by Authenticated UsersEPSS 0.3%CVE-2026-42233MEDIUMn8n: SQL Injection in Oracle Database Node via Limit FieldEPSS 0.3%CVE-2026-92588MEDIUMn8n before 1.123.76 Improper Authorization via Source Control PushEPSS 0.3%CVE-2026-110848MEDIUMn8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection MergeEPSS 0.3%CVE-2026-110842HIGHn8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation InterpreterEPSS 0.3%CVE-2026-77072HIGHn8n before 1.123.69 Stored XSS via Form Completion PageEPSS 0.3%CVE-2026-92587MEDIUMn8n before 1.123.76 Sandbox Escape via Git Relative URLEPSS 0.3%CVE-2026-25631MEDIUMDomain allowlist bypass enables credential exfiltrationEPSS 0.3%CVE-2026-71539HIGHn8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code ExecutionEPSS 0.3%CVE-2026-103258MEDIUMn8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter InterpolationEPSS 0.3%CVE-2026-103248HIGHn8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via SupabaseEPSS 0.3%CVE-2025-68949MEDIUMn8n has a Webhook Node IP Whitelist Bypass via Partial String MatchingEPSS 0.3%CVE-2026-54308MEDIUMn8n: Missing Token Validation on Microsoft Agent 365 Trigger NodeEPSS 0.3%CVE-2026-118641MEDIUMn8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint NodesEPSS 0.3%