CVE-2026-109411 is an access control bypass vulnerability in Samba's experimental vfs_ceph_rgw module. It occurs when an authenticated user accesses files with mismatched case, causing the module to incorrectly treat the operation as creating a new file and skip permission checks. This allows unauthorized reading or overwriting of restricted files on shares configured with this module. The flaw affects Samba versions from 4.25.0 up to but not including 4.25.1. The vulnerability is limited to deployments using the experimental S3-to-SMB gateway feature and is not present in standard Red Hat packages. A fix is available in Samba 4.25.1.
A vulnerability exists in Cisco Secure Firewall ASA Software and Secure FTD Software versions 9.16, 9.16.1, and 9.16.1.28 when the SSL remote access VPN login service is reachable and secondary authentication is configured in the tunnel group scope. The vulnerability affects configurations where the webvpn keyword is enabled on at least one interface and secondary authentication server groups are set in tunnel groups, including the default group DefaultWEBVPNGroup. This exposure occurs even if the tunnel-group-list is disabled, and a successful VPN login is not required to reach the affected processing path.
A vulnerability in the Echo Go web framework versions 5.0.0 through 5.4.0 allows client-supplied X-Real-IP headers to be trusted incorrectly. This can lead to spoofing of the client's IP address in applications relying on this value for security controls. The issue is fixed in version 5.4.1.
A critical HTTP request/response smuggling vulnerability (CVE-2026-118264) affects the Echo Go web framework versions from 4.0.0 up to but not including 4.16.1 and from 5.0.0 up to but not including 5.4.1. The flaw arises in Echo's Proxy middleware, which improperly handles client WebSocket upgrade requests by selecting a raw tunnel before verifying upstream acceptance. If the upstream rejects the upgrade with a keep-alive response, subsequent HTTP requests bypass Echo's routing and middleware, potentially allowing attackers to circumvent authentication or authorization controls enforced by Echo routes. This vulnerability is fixed in versions 4.16.1 and 5.4.1.
CVE-2026-118263 affects the Echo Go web framework versions 5.0.0 through 5.4.0. The vulnerability involves the BodyDump middleware improperly handling BodyLimit overflow errors for unknown-length HTTP requests when the capture limit is below the BodyLimit threshold. This can cause chunked HTTP/1.1 requests to be truncated and processed despite exceeding the configured body size limit. Known-length requests rejected before BodyDump are not affected. The issue does not lead to authentication bypass or denial of service and is fixed in version 5.4.1.
CVE-2026-118262 is a resource management vulnerability in the labstack Echo Go web framework affecting versions 4.15.0 up to but not including 4.16.1, and 5.0.0 up to but not including 5.4.1. The issue occurs in Echo's Proxy middleware where resources such as handlers, goroutines, and network connections may be retained after a WebSocket client disconnects if the upstream connection remains open. This can lead to resource accumulation and potential denial of service. The vulnerability is fixed in versions 4.16.1 and 5.4.1.
MONAI versions before 1.6.1 have a vulnerability in the check_hash() function where the integrity verification is insufficient. Specifically, if the hash value is None, the function incorrectly returns True, and MD5 is used as the default hash algorithm. This flaw allows attackers who can perform man-in-the-middle or registry compromise attacks to substitute malicious bundles, datasets, or model archives downloaded without hashes, potentially leading to malicious file delivery and code execution.
CVE-2026-118679 is a server-side request forgery (SSRF) vulnerability in the Slack Trigger webhook of n8n versions before 1.123.83, 2.41.4, and 2.42.1. This flaw allows unauthenticated attackers to bypass signature verification when no signing secret is set, enabling them to exfiltrate Slack workspace access tokens by triggering the webhook with a specially crafted request. The vulnerability is fixed in versions 1.123.83, 2.41.4, and 2.42.1.
n8n versions before 2.41.4 and 2.42.x before 2.42.1 contain a prototype pollution vulnerability. This flaw allows low-privileged users to manipulate built-in object behavior by saving workflows with specially crafted connection keys such as __proto__. Exploitation can cause server errors affecting logins and writes due to the periodic history compaction task processing these keys.
CVE-2026-118677 is a vulnerability in n8n's Local Gateway desktop app before versions 2.41.4 and 2.42.1. It involves improper authorization in the deep-link connect handler for the custom URL scheme n8n-computer-use://. This flaw allows an attacker to silently re-pair the app with a malicious n8n instance by tricking a user into opening a crafted link, inheriting previously granted permissions and potentially acting on the user's computer through the gateway.
n8n versions before 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows member users to access credentials they should not have permission to use by omitting default node parameters in workflows. Exploiting this, attackers can save and execute workflows that skip pre-execution credential checks, causing decrypted credential values to be sent to destinations controlled by the attacker.
CVE-2026-118675 is a credential guard bypass vulnerability in n8n versions before 1.123.85, 2.43.5, and 2.44.1. It allows editors of shared workflows to access restricted credentials by exploiting the Execute Sub-workflow node with maliciously crafted source URLs or local files. This vulnerability enables attackers to retrieve decrypted credential values improperly.
CVE-2026-118649 is a prototype pollution vulnerability in n8n versions before 2.43.5 and 2.44.x before 2.44.1. The flaw allows an authenticated user with workflow creation and execution privileges to manipulate a client-supplied workflow ID, such as '__proto__', causing the system to incorrectly match all projects. This enables the attacker to list, read, modify, and delete Data Table rows across all projects in the instance.
n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain webhook response paths omit the sandbox Content-Security-Policy header, allowing authenticated users who can create and activate workflows to serve malicious HTML. This HTML executes scripts in the context of the n8n origin, potentially hijacking sessions of users who open the webhook URL.
A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes the SeaTable Trigger node's API token to be saved in error execution data. This occurs because failed poll requests store raw request headers, exposing sensitive API tokens to users who can view workflow executions but do not have credential read access.
n8n versions prior to 1.123.85, 2.43.5, and 2.44.1 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users who can create and run workflows may exploit this by submitting crafted glob patterns with excessive wildcards, causing exponential backtracking. This results in blocking the event loop and making the UI, API, webhooks, and health checks unresponsive until the system is restarted.
CVE-2026-118645 is a filter injection vulnerability in the Quick Base node of n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1. The vulnerability arises because the Where filter is sent as raw query text to the Quick Base API, allowing attackers to manipulate queries using untrusted input such as webhook data. This can lead to unauthorized retrieval of all records or deletion of all records accessible by the workflow credentials.
A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes credential secrets to be stored in execution error data for certain nodes. This exposure allows users who can view workflow executions but lack credential read permissions to recover sensitive Git passwords or tokens, MongoDB database passwords, or Google access tokens.
n8n versions before 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can run Execute Workflow nodes in inline JSON mode to bypass permission checks and exfiltrate decrypted credentials to attacker-controlled servers.
CVE-2026-118641 is an injection vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1. It affects the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which improperly build OData $filter string literals from unescaped expression-bindable parameters. This allows attackers supplying untrusted input to inject single quotes, potentially dumping the entire contact list of the bound mailbox or redirecting SharePoint writes to unintended list items within the stored credential's scope.