CVE-2026-118644 is a vulnerability in n8n versions before 2.41.5 and 2.42.x before 2.42.2 where a failed workflow's full execution context, including the initiating user's identity, is passed to an error workflow. This allows a project editor to manipulate a colleague's workflow settings to inherit their identity upon failure and access their per-user dynamic credential secrets.
A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes credential secrets to be stored in execution error data for certain nodes. This exposure allows users who can view workflow executions but lack credential read permissions to recover sensitive Git passwords or tokens, MongoDB database passwords, or Google access tokens.
n8n versions before 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can run Execute Workflow nodes in inline JSON mode to bypass permission checks and exfiltrate decrypted credentials to attacker-controlled servers.
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.
CVE-2026-118640 is an authorization bypass vulnerability in n8n versions before 1.123.85, 2.43.5, and 2.44.1. It affects the Chat Hub feature, allowing users with the global:chatUser role to register restricted tool types and execute sandboxed code, access permitted files, and use instance workflows, Data Tables, and agents beyond their intended permissions.
n8n versions before 2.41.4 and certain 2.42.x versions before 2.42.1 contain an authorization bypass vulnerability in the Agents create endpoint. This flaw allows an authenticated user with read-only Agent access to one project to supply an existing Agent ID and move that Agent into their own project, enabling them to modify the Agent's name, schema, and version without proper ownership verification.
n8n versions before 2.41.4 and 2.42.x before 2.42.1 contain a signature validation bypass in the waiting-webhook endpoint. This flaw arises because validation occurs before canonicalization of an alternate node reference form, allowing attackers with a workflow execution's resume token to approve waiting executions intended for others. This can lead to unauthorized downstream actions running under the workflow owner's credentials, potentially including command execution.
CVE-2026-110845 is a code execution vulnerability in n8n's Git node Log operation affecting versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1. The vulnerability arises because the node fails to remove a repository's local git configuration before running an external program. Authenticated users with permission to configure the node can exploit this by pointing it to a repository with a malicious local configuration, leading to code execution as the n8n process user.
n8n versions before 2.41.4 and 2.42.0 contain an authorization bypass vulnerability in the agent chat resume endpoint. This flaw allows authenticated project members to access and manipulate other members' private agent conversations by providing a run identifier without proper ownership verification. Exploitation can lead to unauthorized reading of private conversations and execution of tool calls within the victim's context.
CVE-2026-92588 is an authorization bypass vulnerability in the n8n workflow automation platform affecting versions prior to 1.123.76, 2.37.7, and 2.38.2. The flaw allows authenticated project-scoped users to push deletions of workflows and credentials from projects they do not have access to by manipulating file paths and statuses in the source control push endpoint. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue has been fixed in the specified versions.
CVE-2026-92587 is a medium severity vulnerability in the n8n workflow automation platform affecting certain versions before 1.123.76, 2.37.7, and 2.38.2. The Git node improperly validated relative remote URLs, allowing an authenticated user to bypass sandbox restrictions and access git repositories outside the intended directory. This could lead to unauthorized reading of repository contents. The issue is fixed in versions 1.123.76, 2.37.7, and 2.38.2. A workaround is to disable the Git node by excluding it via configuration.
n8n versions prior to 2.36.2 contain an authorization bypass vulnerability in the Insights API routes. Authenticated users with insights scopes can exploit this flaw by supplying arbitrary projectId parameters to access workflow names and execution statistics from projects they are not members of. This issue is fixed in versions 2.36.2 and 2.35.4.
A server-side request forgery (SSRF) vulnerability exists in n8n versions before 2.34.1 due to inconsistent validation of request properties in the legacy request helper function. This flaw allows attackers to bypass SSRF protections by supplying a safe 'uri' property alongside a malicious 'url' property, potentially accessing internal network resources.
n8n versions before 1.123.73, 2.35.4, and 2.36.2 have a vulnerability where decrypted credentials from certain nodes are logged in plaintext within execution error data. Authenticated users can access these plaintext secrets via the REST API, bypassing normal redaction protections.
CVE-2026-85170 is an improper input validation vulnerability in n8n versions before 1.123.73, 2.35.4, and 2.36.2. The flaw affects the Gmail (v1) and Brevo nodes, where message content is passed to the mail composer without verifying it is a string. An authenticated user running a workflow can supply an expression resolving to an object with a path or href property, causing the composer to read local files accessible to the n8n process or fetch internal URLs (SSRF) and attach the results to outgoing messages.
CVE-2026-85169 is a high-severity code injection vulnerability in n8n versions before 1.123.73, 2.35.4, and 2.36.2. It involves an expression sandbox escape in the $fromAI handler, allowing an attacker with workflow-build privileges to execute arbitrary code by exploiting prototype chain traversal to the Function constructor. This leads to remote code execution in the main n8n process.
n8n versions prior to 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. This flaw arises because certain Git configuration keys related to content-filter and merge-driver were not properly neutralized, allowing execution of arbitrary commands as the n8n process user during common Git operations.
CVE-2026-85167 is a query injection vulnerability in n8n versions before 2.35.4 and 2.36.x before 2.36.2. The flaw exists in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, where JSON queries are constructed by directly interpolating expression values. This allows specially crafted input containing quote and brace characters to manipulate the query logic, potentially escalating a single-document lookup into a full-collection read.
CVE-2026-85166 is an authorization vulnerability in n8n versions before 2.35.4 and 2.36.x before 2.36.2. The flaw allows users with limited privileges to persist workflow nodes referencing credentials they do not own. When such workflows execute under an identity that holds the referenced credential, the secret can be exfiltrated to an attacker-controlled endpoint via inline sub-workflows.
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability that allows authenticated users with workflow-edit permissions to mutate host process globals via expression evaluation. This mutation persists process-wide until the service is restarted. The vulnerability affects versions prior to 2.35.4 and between 2.36.0 and before 2.36.2.