A Cross-Site Request Forgery (CSRF) vulnerability exists in the labstack Echo Go web framework prior to versions 4.16.0 and 5.4.0. The issue arises when the MethodOverride middleware is registered before the CSRF middleware in the post-routing chain, allowing an attacker to bypass CSRF token validation and Sec-Fetch-Site checks by overriding the HTTP method of a POST request. This can lead to unauthorized state-changing actions if the victim is authenticated and the override value is controllable via a browser-submitted request. The vulnerability is fixed in versions 4.16.0 and 5.4.0.
A vulnerability in the Echo Go web framework versions 5.0.0 through 5.4.0 allows client-supplied X-Real-IP headers to be trusted incorrectly. This can lead to spoofing of the client's IP address in applications relying on this value for security controls. The issue is fixed in version 5.4.1.
A critical HTTP request/response smuggling vulnerability (CVE-2026-118264) affects the Echo Go web framework versions from 4.0.0 up to but not including 4.16.1 and from 5.0.0 up to but not including 5.4.1. The flaw arises in Echo's Proxy middleware, which improperly handles client WebSocket upgrade requests by selecting a raw tunnel before verifying upstream acceptance. If the upstream rejects the upgrade with a keep-alive response, subsequent HTTP requests bypass Echo's routing and middleware, potentially allowing attackers to circumvent authentication or authorization controls enforced by Echo routes. This vulnerability is fixed in versions 4.16.1 and 5.4.1.
CVE-2026-118263 affects the Echo Go web framework versions 5.0.0 through 5.4.0. The vulnerability involves the BodyDump middleware improperly handling BodyLimit overflow errors for unknown-length HTTP requests when the capture limit is below the BodyLimit threshold. This can cause chunked HTTP/1.1 requests to be truncated and processed despite exceeding the configured body size limit. Known-length requests rejected before BodyDump are not affected. The issue does not lead to authentication bypass or denial of service and is fixed in version 5.4.1.
n8n versions before 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows member users to access credentials they should not have permission to use by omitting default node parameters in workflows. Exploiting this, attackers can save and execute workflows that skip pre-execution credential checks, causing decrypted credential values to be sent to destinations controlled by the attacker.
CVE-2026-118675 is a credential guard bypass vulnerability in n8n versions before 1.123.85, 2.43.5, and 2.44.1. It allows editors of shared workflows to access restricted credentials by exploiting the Execute Sub-workflow node with maliciously crafted source URLs or local files. This vulnerability enables attackers to retrieve decrypted credential values improperly.
CVE-2026-118649 is a prototype pollution vulnerability in n8n versions before 2.43.5 and 2.44.x before 2.44.1. The flaw allows an authenticated user with workflow creation and execution privileges to manipulate a client-supplied workflow ID, such as '__proto__', causing the system to incorrectly match all projects. This enables the attacker to list, read, modify, and delete Data Table rows across all projects in the instance.
n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain webhook response paths omit the sandbox Content-Security-Policy header, allowing authenticated users who can create and activate workflows to serve malicious HTML. This HTML executes scripts in the context of the n8n origin, potentially hijacking sessions of users who open the webhook URL.
A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes the SeaTable Trigger node's API token to be saved in error execution data. This occurs because failed poll requests store raw request headers, exposing sensitive API tokens to users who can view workflow executions but do not have credential read access.
n8n versions prior to 1.123.85, 2.43.5, and 2.44.1 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users who can create and run workflows may exploit this by submitting crafted glob patterns with excessive wildcards, causing exponential backtracking. This results in blocking the event loop and making the UI, API, webhooks, and health checks unresponsive until the system is restarted.
CVE-2026-118645 is a filter injection vulnerability in the Quick Base node of n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1. The vulnerability arises because the Where filter is sent as raw query text to the Quick Base API, allowing attackers to manipulate queries using untrusted input such as webhook data. This can lead to unauthorized retrieval of all records or deletion of all records accessible by the workflow credentials.
A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes credential secrets to be stored in execution error data for certain nodes. This exposure allows users who can view workflow executions but lack credential read permissions to recover sensitive Git passwords or tokens, MongoDB database passwords, or Google access tokens.
n8n versions before 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can run Execute Workflow nodes in inline JSON mode to bypass permission checks and exfiltrate decrypted credentials to attacker-controlled servers.
CVE-2026-118641 is an injection vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1. It affects the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which improperly build OData $filter string literals from unescaped expression-bindable parameters. This allows attackers supplying untrusted input to inject single quotes, potentially dumping the entire contact list of the bound mailbox or redirecting SharePoint writes to unintended list items within the stored credential's scope.
CVE-2026-118640 is an authorization bypass vulnerability in n8n versions before 1.123.85, 2.43.5, and 2.44.1. It affects the Chat Hub feature, allowing users with the global:chatUser role to register restricted tool types and execute sandboxed code, access permitted files, and use instance workflows, Data Tables, and agents beyond their intended permissions.
MIME::Words versions before 5.521 for Perl contain a vulnerability in the decode_mimewords function that allows memory exhaustion. This occurs when repeated "=?" sequences that do not form complete encoded words cause the function to append large error messages repeatedly, leading to significant memory consumption. From version 5.518, MIME::Parser decodes multipart boundaries using this function, enabling a remote sender to trigger this exhaustion via a crafted Content-Type header.
MIME::Field::ParamVal versions before 5.521 for Perl do not properly flag duplicate boundary parameters when the parameter name contains a nested comment. This causes the parser to store such parameters under their literal names instead of the expected 'boundary' name, allowing a second boundary parameter to go undetected as a duplicate. As a result, MIME::Parser splits the message on the second boundary, while readers that skip comments per RFC 5322 take the first boundary. This discrepancy allows a remote sender to hide an attachment from filters relying on ambiguous_content(), although the recipient's mail client will display the attachment.
MIME::Field::ParamVal versions before 5.521 for Perl have a vulnerability where an invalid Content-Type parameter causes the parser to stop processing subsequent parameters, including the multipart boundary. This allows a remote sender to hide attachments from filters relying on ambiguous_content() detection, while the recipient's mail client still displays the attachment.
MIME::Field::ParamVal versions before 5.521 for Perl do not properly flag ambiguous multipart boundaries when written as RFC 2231 continuations. This flaw allows a remote sender to craft a MIME message that causes MIME::Parser to split the message on a different boundary than other mail readers, potentially hiding attachments from filters relying on ambiguous_content() checks while the recipient's mail client displays them.
CVE-2026-118608 is an out-of-bounds read vulnerability in the prh_rfcomm_cc_process_test function of the libanwbtstack.so component on Alpine iLX-F511 devices. This flaw allows network-adjacent attackers who can pair a malicious Bluetooth device with the target to disclose sensitive information. The vulnerability arises from improper validation of user-supplied data, leading to reading beyond allocated buffer boundaries. It has a low CVSS score of 3.5 and does not impact integrity or availability.