Vulnerabilidades em n8n
22 resultadosAnálise Vexday
A n8n apresenta 22 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando exposição recente e concentrada. Nenhuma vulnerabilidade crítica (CVSS ≥9.0) ou sob exploração ativa (KEV) foi registrada até o momento, porém a dominância de CWE-79 (Cross-site Scripting) sugere fraquezas em validação de entrada que requerem atenção. O volume de CVEs em curto período demanda avaliação urgente do ciclo de patches do fornecedor e do impacto operacional para ambientes em produção.
CVE-2025-71380HIGHn8n - Arbitrary Command Execution via Execute Command NodeEPSS 0.4%CVE-2026-56349MEDIUMn8n - Guardrail Node Bypass via Crafted InputEPSS 0.3%CVE-2026-59259MEDIUMn8n - Permission Bypass via Expression Parser Mismatch in External SecretsEPSS 0.3%CVE-2026-59257MEDIUMn8n - SQL Injection in MySQL v1 executeQuery Operation via Expression InterpolationEPSS 0.3%CVE-2026-59254MEDIUMn8n - External Secrets Disclosure via Workflow Node ExpressionsEPSS 0.3%CVE-2026-56348MEDIUMn8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters EndpointEPSS 0.3%CVE-2026-56350MEDIUMn8n - SSO Enforcement Bypass via APIEPSS 0.3%CVE-2026-56352MEDIUMn8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile ParameterEPSS 0.2%CVE-2026-56777MEDIUMn8n - AST Validator Bypass in Python Code NodeEPSS 0.2%CVE-2026-56353MEDIUMn8n - Authentication Bypass in Chat Trigger NodeEPSS 0.2%CVE-2026-58661MEDIUMn8n - Disk Space Exhaustion via Data-Table File Upload EndpointEPSS 0.2%CVE-2026-56351MEDIUMn8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL NodesEPSS 0.2%CVE-2026-56357MEDIUMn8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook TriggerEPSS 0.2%CVE-2026-56360MEDIUMn8n - Webhook Forgery via Unsigned POST Requests in ZendeskTriggerEPSS 0.2%CVE-2026-56356MEDIUMn8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS FieldEPSS 0.2%CVE-2026-56775MEDIUMn8n - Incorrect OAuth Scope Validation in Evaluation Test Runs EndpointsEPSS 0.2%CVE-2026-56778MEDIUMn8n - Authorization Bypass in Public API Execution Retry EndpointEPSS 0.2%CVE-2026-56354MEDIUMn8n - Cross-Site Scripting and Open Redirect in Form NodeEPSS 0.2%CVE-2026-59253MEDIUMn8n - Improper Authorization in Workflow Assignment to FoldersEPSS 0.2%CVE-2026-56776MEDIUMn8n - Incorrect OAuth Scope Validation in Workflow Test Run EndpointEPSS 0.2%