CVE-2026-54308mediumCWE-290

CVE-2026-54308: fallo de gravedad media en n8n-io n8n

n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear n8n+ Monitorear n8n

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.3%
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Productos afectados
n8n-io · n8n
CVEs relacionadas — n8n-io n8n

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-68613CRITICALn8n Vulnerable to Remote Code Execution via Expression InjectionEPSS 99.0%KEVCVE-2026-21858CRITICALn8n Vulnerable to Unauthenticated File Access via Improper Webhook Request HandlingEPSS 78.2%CVE-2025-68668CRITICALn8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code NodeEPSS 13.2%CVE-2026-27577CRITICALn8n: Expression Sandbox Escape Leads to RCEEPSS 10.7%CVE-2026-21877CRITICALn8n is vulnerable to Remote Code Execution via Arbitrary File WriteEPSS 5.4%CVE-2026-25055HIGHn8n Arbitrary File Write on Remote Systems via SSH NodeEPSS 1.9%