Vulnerabilidades em n8n-io

206 resultados
Análise Vexday

O ecossistema n8n-io acumula 79 CVEs catalogadas, com 23 classificadas como críticas e um volume expressivo de 33 vulnerabilidades surgidas apenas nos últimos 90 dias, sinalizando uma superfície de ataque em expansão acelerada. A taxa de exploração ativa está 2,8× acima da média geral do catálogo CISA KEV, o que indica que, apesar do número absoluto pequeno, as falhas presentes nesse produto atraem atenção real de atores maliciosos de forma desproporcional. O destaque de maior risco é CVE-2025-68613, com score EPSS de 0,9788 — próximo ao teto máximo de probabilidade de exploração —, confirmada em exploração ativa e exigindo atenção imediata de equipes de resposta. O tipo de falha mais prevalente é CWE-79 (Cross-Site Scripting), uma classe de vulnerabilidade que, em plataformas de automação com integrações externas como o n8n, pode ter impacto amplificado por viabilizar comprometimento de fluxos e credenciais encadeadas.

CVE-2026-103255HIGHn8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via SupabaseEPSS 0.3%CVE-2026-65597HIGHn8n before 1.123.64 DOM-Based XSS via Unsandboxed iframeEPSS 0.3%CVE-2026-86996MEDIUMn8n: Agent Workflow Tool Bypasses Sub-Workflow Caller PolicyEPSS 0.3%CVE-2026-77069LOWn8n before 1.123.69 SSRF Protection Bypass via OAuth2EPSS 0.3%CVE-2026-118678HIGHn8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History CompactionEPSS 0.3%CVE-2026-33724MEDIUMn8n's Source Control SSH Configuration Uses StrictHostKeyChecking=noEPSS 0.3%CVE-2026-110840HIGHn8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query FieldEPSS 0.3%CVE-2026-110843HIGHn8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize EndpointEPSS 0.3%CVE-2026-110844HIGHn8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-WorkflowsEPSS 0.3%CVE-2026-110841MEDIUMn8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool ApprovalEPSS 0.3%CVE-2026-103260MEDIUMn8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait NodeEPSS 0.3%CVE-2026-54306MEDIUMn8n: Prototype Pollution enables confused-deputy execution via public webhooksEPSS 0.3%CVE-2026-103254HIGHn8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL GenerationEPSS 0.3%CVE-2026-103252HIGHn8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test EndpointEPSS 0.3%CVE-2026-118679MEDIUMn8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack TriggerEPSS 0.3%CVE-2026-27496HIGHn8n has In-Process Memory Disclosure in its Task RunnerEPSS 0.3%CVE-2026-118649HIGHn8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data TablesEPSS 0.3%CVE-2025-46343MEDIUMn8n Vulnerable to Stored XSS through Attachments View EndpointEPSS 0.3%CVE-2025-68697HIGHSelf-hosted n8n has Legacy Code node that enables arbitrary file read/writeEPSS 0.3%CVE-2026-59208HIGHn8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity ResolutionEPSS 0.3%