CVE-2026-103254 is a path traversal vulnerability in n8n affecting versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. The flaw exists in the signed resume URL generation for Send-and-Wait approvals, allowing attackers with workflow creation permissions to forge approval URLs for projects they do not have access to by exploiting unresolved traversal sequences in node IDs. This enables cross-project approval forgery.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
CVE-2026-103251 is a high-severity vulnerability in n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. It involves a validation bypass in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass multiple security checks to install arbitrary npm packages across all cluster instances without authentication.
A NoSQL injection vulnerability exists in n8n's MongoDB Chat Memory node due to improper validation of the sessionId parameter. This affects n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. Unauthenticated attackers can exploit this flaw to access other users' conversation histories and perform unauthorized write and delete operations.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
n8n versions before 1.123.80 have a credential tampering vulnerability that allows attackers with editor access to shared workflows to bypass the workflow credential tamper guard. This is achieved through duplicate node IDs causing mismatched node ID and name matching, enabling retention of victim credentials and redirection of secrets to attacker-controlled hosts.
CVE-2026-103246 is a high-severity authorization bypass vulnerability in n8n versions before 2.39.6 and versions 2.40.0 before 2.40.1. The flaw allows attackers to bypass credential ownership validation during inline agent node-tool introspection, enabling them to reference arbitrary credential IDs. This can lead to decryption and exfiltration of plaintext secrets to attacker-controlled hosts without verifying ownership.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
CVE-2026-92588 is an authorization bypass vulnerability in the n8n workflow automation platform. In affected versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint uses client-supplied file paths and statuses instead of server-validated data. This allows an authenticated project-scoped user to delete workflows and credentials from projects they do not have access to, causing cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue is fixed in versions 1.123.76, 2.37.7, and 2.38.2.
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolved the same relative URL from there. An authenticated user (member) who nested the repository one level below the configured path could therefore make an identical URL string pass the file-access check while git resolved it outside the sandbox. A subsequent fetch or pull read a git repository outside N8N_RESTRICT_FILE_ACCESS_TO and merged its objects into the user's own repository, where their contents could be read back. The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2, which resolve the remote reference from the directory git actually operates in before applying the sandbox check. As a workaround, the Git node can be disabled by adding n8n-nodes-base.git to NODES_EXCLUDE.
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2.
CVE-2026-86078 is a prototype pollution vulnerability in the n8n workflow automation platform. Prior to versions 2.37.7 and 2.38.2, the Instance AI workflow summary function improperly used node names and connection keys from stored workflows as object keys, allowing crafted workflows submitted via the REST API to modify Object.prototype. This could disrupt subsequent requests in the main n8n process. The vulnerability is fixed in versions 2.37.7 and 2.38.2.
CVE-2026-86079 is a path traversal vulnerability in the n8n workflow automation platform affecting Elasticsearch and ElasticSecurity nodes. Prior to versions 1.123.76, 2.37.7, and 2.38.2, these nodes interpolated workflow-controlled identifiers directly into REST request paths without proper encoding. This allowed an attacker to craft identifiers with path separators or dot segments to access unauthorized indices or cluster administration endpoints using stored Elasticsearch credentials. The vulnerability is fixed in versions 1.123.76, 2.37.7, and 2.38.2.
CVE-2026-86080 is a medium severity vulnerability in the n8n open source workflow automation platform. It involves improper verification of cryptographic signatures in the GitHub Trigger node. Prior to fixed versions, the webhook secret was discarded under certain error conditions, causing the system to accept webhook deliveries without proper signature verification. This issue is resolved in n8n versions 1.123.76, 2.37.7, and 2.38.2.
CVE-2026-86081 is a high-severity vulnerability in the n8n workflow automation platform. It involves inefficient regular expression complexity in the Git node clone operation, which uses a regex pattern vulnerable to catastrophic backtracking. An authenticated workflow editor can exploit this to freeze the n8n instance during workflow execution. The issue affects versions prior to 1.123.76, 2.37.7, and 2.38.2 and has been fixed in these versions.