CVE-2026-59254 is a vulnerability in n8n that allows authenticated users with project editor access to read plaintext external secrets through workflow node expressions, bypassing intended access controls. This affects instances where the external secrets feature is enabled. The vulnerability is fixed in versions 2.27.4 and 2.28.1. Temporary mitigations include restricting project membership to trusted users and avoiding granting editor access where external secrets are configured.
CVE-2026-59257 is a SQL injection vulnerability in the n8n MySQL v1 node's executeQuery operation. It arises from unparameterized expression interpolation, allowing attacker-controlled input to be directly included in SQL queries. This can lead to unauthorized data disclosure, modification, or deletion in workflows using this node with externally reachable triggers. The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Temporary mitigations include disabling the MySQL v1 node, restricting access to affected workflows, enforcing authentication on webhook endpoints, or migrating to the MySQL v2 node which uses parameterized queries.
CVE-2026-59259 is a vulnerability in n8n that allows an authenticated user with credential create or update permissions, but lacking the externalSecret:list scope, to bypass permission checks. This occurs due to a mismatch between static validation and runtime expression parsing, potentially exposing secret values during workflow execution. The issue affects instances using an external secrets provider with Advanced Permissions enabled. Fixed versions include 1.123.61, 2.27.4, and 2.28.1 or later.
A path-confinement bypass vulnerability exists in the n8n component '@n8n/computer-use' file-search tool. This flaw allows crafted search patterns to escape the configured base directory, enabling reading of arbitrary files accessible to the daemon's OS user outside the intended sandbox. The issue affects deployments where an attacker can influence the search input. Fixed in n8n versions 2.31.5 and 2.32.1, users should upgrade to these or later versions. Temporary mitigations include restricting access to trusted users, disabling affected workflows, and running n8n under a low-privilege user account.
An authenticated user in n8n can exploit the VM expression engine to perform prototype pollution via array-element access, causing a denial of service in the main process. This affects both self-hosted and cloud instances using the vulnerable VM expression engine. The vulnerability is fixed in versions 1.123.67, 2.31.5, and 2.32.1. Temporary mitigations include restricting access to trusted users and disabling the VM expression engine if possible.
n8n contains a prototype pollution vulnerability in the Edit Fields (Set) node that allows an authenticated user to assign output fields using dot-notation paths without restricting field names. This can corrupt a shared global in the Node.js process, causing all authenticated requests to fail and resulting in an instance-wide denial of service until the process is restarted. The issue is fixed in versions 1.123.67, 2.31.5, and 2.32.1. Temporary mitigations include restricting access to trusted users and monitoring for HTTP 500 errors.
The n8n Edit Image node had a vulnerability where it passed the output format to the image library without validation, allowing an authenticated user running workflows to write arbitrary files outside the node's working directory. This could lead to arbitrary file writes on the n8n instance. The issue is fixed in versions 1.123.67, 2.31.5, and 2.32.1. Temporary mitigations include restricting access to trusted users and disabling the Edit Image node via environment configuration.
n8n contains a vulnerability where credential-access checks do not validate credentials referenced inside an Execute Sub-workflow node's inline JSON. This allows a user with editor access to a shared workflow to exfiltrate credentials they are not authorized to use by embedding them in the inline sub-workflow JSON. Exploitation requires workflow sharing enabled, editor access, and knowledge of the target credential ID. The issue is fixed in versions 1.123.67, 2.31.5, and 2.32.1. Temporary mitigations include restricting workflow sharing, auditing sub-workflows for credential references, and limiting network egress.
An authorization bypass vulnerability exists in n8n's HTTP Request node where an authenticated user with edit access to a shared workflow can reference another user's credential by specifying the credential type via an expression. This bypasses ownership checks due to improper pre-execution validation, allowing unauthorized use or exfiltration of credentials if the attacker knows the credential identifier. The issue affects versions prior to 1.123.67 and versions from 2.32.0 up to but not including 2.32.1. Fixed versions are 1.123.67, 2.31.5, and 2.32.1 or later. Temporary mitigations include restricting access to trusted users, excluding the HTTP Request node if not needed, and auditing credential sharing. No known exploits in the wild have been reported.
An authenticated user with permission to create or modify workflows in n8n can exploit a vulnerability in expression evaluation using arrow functions to escape the sandbox and execute arbitrary system commands on the host. This issue affects n8n versions before 2.31.5 and versions 2.32.0 up to but not including 2.32.1. The vulnerability has been fixed in versions 2.31.5 and 2.32.1. Temporary mitigations include restricting access and workflow editing permissions to fully trusted users until an upgrade can be applied.
The n8n Send Email node had a vulnerability where it did not enforce that message fields were strings, allowing crafted non-string inputs to be interpreted as file paths or URLs by the underlying mail library. This could lead to arbitrary local file disclosure or SSRF on the n8n host. Exploitation requires an active workflow with an unauthenticated webhook, valid SMTP credentials, and untrusted input mapped directly into email body fields, which is not the default configuration. The issue is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Temporary mitigations include auditing workflows, restricting webhook access, and limiting workflow editing permissions.
Authenticated users of n8n with workflow creation and execution rights can achieve code execution on the host via the Git node. This occurs when the Git node, under default security settings, processes a crafted local repository that triggers git hooks to run arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected if these conditions are met. The vulnerability is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1 and later. Temporary mitigations include restricting access to trusted users, disabling the Git node, and limiting network egress. These mitigations do not fully resolve the risk and upgrading is recommended.
A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the MCP Client node of n8n. Authenticated users with workflow creation or editing permissions could exploit this to make the server connect to internal or blocked hosts, bypassing SSRF protections and potentially exposing internal services. The issue is fixed in n8n versions 2.31.5 and 2.32.1. Temporary mitigations include restricting access to trusted users, disabling the MCP Client node, and limiting network egress to internal address ranges.
Authenticated users of n8n with workflow create or execute permissions could exploit a vulnerability in the Git node's fetch, pull, or push-tags operations to bypass repository path restrictions. This allows them to access local git repositories outside the intended sandbox, potentially reading files and history. The issue is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1 and later. Temporary mitigations include restricting access to trusted users and disabling the Git node, but these do not fully resolve the risk.
A vulnerability in n8n allows bypassing the "Allowed HTTP Request Domains" credential restriction in multiple AI and LLM nodes. This restriction was designed to prevent credential secrets from being sent to unauthorized hosts. The flaw permits a low-privileged user with use-only access to a shared credential to redirect requests to an attacker-controlled host, exposing the credential secret. The issue affects instances where the credential has domain restrictions configured and is shared with non-owner users. Fixed in versions 2.31.5 and 2.32.1, users should upgrade to these or later versions. Temporary mitigations include restricting workflow editing and credential sharing to trusted users and auditing credential sharing, but these do not fully remediate the risk.
An account takeover vulnerability exists in n8n when the embed login feature is enabled and trusted key sources are configured. The service fails to verify that the email claim in a valid token is verified or that the token's permitted role ceiling covers the local account. This allows an attacker with a token accepted by a trusted key (e.g., from a trusted issuer emitting unverified emails) to authenticate as any user and gain full account control. The issue is fixed in n8n version 2.32.1. Temporary mitigations include disabling embed login or restricting network access and auditing trusted keys and token-exchange records.
A race condition vulnerability exists in the Git clone node of n8n before versions 1.123.64, 2.29.8, and 2.30.1. Authenticated users can exploit a time-of-check to time-of-use (TOCTOU) issue by replacing a directory with a symlink after path validation but before cloning. This allows planting a crafted repository that n8n loads as a custom node on restart, leading to arbitrary JavaScript execution on the server. Both self-hosted and cloud instances are affected. This advisory is a duplicate and has been withdrawn in favor of GHSA-g3r5-9h93-4j2c.
n8n versions before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contain a DOM-based cross-site scripting (XSS) vulnerability in the HTML preview feature. The vulnerability arises because the execution output is rendered into an iframe srcdoc without the sandbox attribute, allowing a sanitizer bypass that enables injected scripts to execute with the same origin as the editor. An attacker with global:member privileges can exploit this by causing a victim to open the preview, enabling the injected script to call authenticated APIs using the victim's session.
n8n versions before 1.123.64, 2.29.8, and 2.30.1 have a vulnerability where the full Google Service Account private key is exposed in the JWT header's kid field. This exposure occurs because the private key was mistakenly placed in a Base64-encoded JWT header, which is not encrypted. An attacker with access to the JWT could recover the private key and impersonate the service account, potentially accessing or modifying authorized Google Cloud resources. Only instances configured with Google Service Account credentials are affected. This advisory is a duplicate and has been withdrawn in favor of GHSA-9r8p-h6cc-6qhm.
n8n versions before 1.123.64 do not properly mask custom HTTP header credentials in LLM sub-node execution data. This results in plaintext API keys and secrets being written to workflow execution records. Authenticated users with access to these execution records can read and export these exposed credentials, which persist in the database. This vulnerability is categorized under CWE-532 (Exposure of Sensitive Information). The advisory is a duplicate and has been withdrawn in favor of GHSA-89gh-3pgc-v5h2.