n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 have an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the error message includes sensitive information such as decrypted credential secrets in the request headers. This sensitive data is stored verbatim in the execution engine's run data, accessible to any authenticated user who can read the execution results.
n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 have an expression injection vulnerability in the resource-locator field used for link preview rendering. This flaw allows an authenticated user to inject malicious JavaScript expressions that are evaluated in the context of other users when they open the affected node in the editor, resulting in cross-user script execution.
CVE-2026-77074 is a medium severity vulnerability in n8n versions before 1.123.69 that affects the Edit Image node's Draw Text operation. Authenticated users can exploit this flaw to inject MVG primitives, enabling blind outbound HTTP requests to arbitrary addresses or access to local files. The vulnerability arises from improper control of code generation, specifically a server-side request forgery (SSRF) vector. Multiple version ranges of n8n are affected, including versions before 1.123.69 and certain 2.x releases prior to specific patch versions.
n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 contain a stored cross-site scripting (XSS) vulnerability in the Form node's completion page. This vulnerability arises because the completion page applies its Content-Security-Policy sandbox only when respondWith is not set to 'redirect', but always renders responseText as raw HTML. An authenticated user can exploit this by setting respondWith to 'redirect' while keeping responseText populated, causing unsanitized HTML and scripts to be served from the n8n origin. Visitors submitting the affected public form may have malicious scripts execute in their session context.
CVE-2026-77071 is a SQL injection vulnerability in the n8n workflow automation tool affecting the Supabase node's Row Get Many, Delete, and Update operations. The flaw arises from improper neutralization of special elements in SQL commands, allowing an attacker to inject conditions that expand filters beyond intended single-row operations. This can lead to full-table data disclosure, deletion, or modification. The vulnerability affects multiple versions prior to 1.123.69, 2.33.4, and 2.34.1. It has a high severity score of 7.1. No known exploits are reported in the wild, and no vendor patch links were provided in the input data.
CVE-2026-77083 is a prototype pollution vulnerability in the JavaScript Code node's VM sandbox of the n8n workflow automation platform. In affected versions, the sandbox does not freeze Function.prototype, allowing an authenticated user with workflow execution privileges to modify the prototype and escape the sandbox. This vulnerability requires the presence of specific allowlisted modules in the deployment configuration to complete the exploit chain. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1.
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.
n8n, an open source workflow automation platform, contains a prototype pollution vulnerability (CWE-1321) in versions prior to 1.123.61, 2.27.4, and 2.28.1. An authenticated user with the default workflow:create permission can craft workflows that pollute Object.prototype via the workflow API. This pollution can cause unauthenticated requests to be treated as privileged users, exposing user and project listing endpoints. The issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow and overwrite the stored token material for that credential with tokens bound to an external account they control. Workflows relying on the affected credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of shared integrations. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.
n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8N_RESTRICT_FILE_ACCESS_TO file sandbox. This allowed the contents of any local git repository accessible to the n8n process to be cloned into an allowed path and read, circumventing the access restrictions that correctly blocked direct file reads to the same paths. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access. This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2.