n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
n8n versions before 1.123.80 have a credential tampering vulnerability that allows attackers with editor access to shared workflows to bypass the workflow credential tamper guard. This is achieved through duplicate node IDs causing mismatched node ID and name matching, enabling retention of victim credentials and redirection of secrets to attacker-controlled hosts.
CVE-2026-92588 is an authorization bypass vulnerability in the n8n workflow automation platform affecting versions prior to 1.123.76, 2.37.7, and 2.38.2. The flaw allows authenticated project-scoped users to push deletions of workflows and credentials from projects they do not have access to by manipulating file paths and statuses in the source control push endpoint. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue has been fixed in the specified versions.
CVE-2026-92587 is a medium severity vulnerability in the n8n workflow automation platform affecting certain versions before 1.123.76, 2.37.7, and 2.38.2. The Git node improperly validated relative remote URLs, allowing an authenticated user to bypass sandbox restrictions and access git repositories outside the intended directory. This could lead to unauthorized reading of repository contents. The issue is fixed in versions 1.123.76, 2.37.7, and 2.38.2. A workaround is to disable the Git node by excluding it via configuration.
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2.
CVE-2026-86078 is a prototype pollution vulnerability in the n8n workflow automation platform. Prior to versions 2.37.7 and 2.38.2, the Instance AI workflow summary function improperly used node names and connection keys from stored workflows as object keys, allowing crafted workflows submitted via the REST API to modify Object.prototype. This could disrupt subsequent requests in the main n8n process. The vulnerability is fixed in versions 2.37.7 and 2.38.2.
CVE-2026-86079 is a path traversal vulnerability in the n8n workflow automation platform affecting Elasticsearch and ElasticSecurity nodes. Prior to versions 1.123.76, 2.37.7, and 2.38.2, these nodes interpolated workflow-controlled identifiers directly into REST request paths without proper encoding. This allowed an attacker to craft identifiers with path separators or dot segments to access unauthorized indices or cluster administration endpoints using stored Elasticsearch credentials. The vulnerability is fixed in versions 1.123.76, 2.37.7, and 2.38.2.
CVE-2026-86080 is a medium severity vulnerability in the n8n open source workflow automation platform. It involves improper verification of cryptographic signatures in the GitHub Trigger node. Prior to fixed versions, the webhook secret was discarded under certain error conditions, causing the system to accept webhook deliveries without proper signature verification. This issue is resolved in n8n versions 1.123.76, 2.37.7, and 2.38.2.
CVE-2026-86081 is a high-severity vulnerability in the n8n workflow automation platform. It involves inefficient regular expression complexity in the Git node clone operation, which uses a regex pattern vulnerable to catastrophic backtracking. An authenticated workflow editor can exploit this to freeze the n8n instance during workflow execution. The issue affects versions prior to 1.123.76, 2.37.7, and 2.38.2 and has been fixed in these versions.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses. The affected controller is packages/cli/src/controllers/role.controller.ts, which omitted the project:list scope check. This issue is fixed in versions 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint. The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
An incorrect authorization vulnerability (CWE-863) exists in the n8n workflow automation platform prior to versions 2.37.7 and 2.38.1. The OAuth token endpoint did not properly bind refresh tokens to the originally consented resource, allowing an OAuth client authorized for one workflow to obtain a valid token for a different, unapproved workflow by substituting the resource parameter. This issue is fixed in versions 2.37.7 and 2.38.1.
CVE-2026-77085 is a Server-Side Request Forgery (SSRF) vulnerability in n8n versions before 2.34.1 and 2.33.x before 2.33.4. The issue arises from the SearXNG Agent tool sending requests to user-supplied API URLs using a raw HTTP client that bypasses n8n's centralized SSRF protection. An authenticated user with permission to create SearXNG credentials and configure a personal agent can exploit this to make the n8n server connect to internal hosts and return their response content.
n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes. This vulnerability arises because user-supplied regex patterns are compiled and executed synchronously without complexity checks or timeouts, allowing crafted patterns to block the worker thread and delay workflow executions.
n8n versions before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 have an authorization bypass vulnerability in the GraphQL node related to the allowed-domains policy. When the Authentication parameter is set to expression mode, multiple credentials of different types are treated incorrectly, allowing an authenticated user with workflow-authoring rights to exfiltrate domain-restricted credentials to attacker-controlled endpoints.