CVE-2026-77084 is a high-severity OS command injection vulnerability in the n8n automation tool's Git node. Versions before 1.123.69 and certain 2.x versions prior to 2.33.4/2.34.1 are affected. The vulnerability arises because the Git node executes repository-local git configuration values without proper neutralization, allowing malicious values to be executed as the n8n process user. Exploitation requires an additional file-write vulnerability to plant the malicious configuration value, as the Git node's own configuration controls do not allow direct exploitation.
n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes. This vulnerability arises because user-supplied regex patterns are compiled and executed synchronously without complexity checks or timeouts, allowing crafted patterns to block the worker thread and delay workflow executions.
n8n versions before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 have an authorization bypass vulnerability in the GraphQL node related to the allowed-domains policy. When the Authentication parameter is set to expression mode, multiple credentials of different types are treated incorrectly, allowing an authenticated user with workflow-authoring rights to exfiltrate domain-restricted credentials to attacker-controlled endpoints.
CVE-2026-77080 is a high-severity vulnerability in n8n that allows an authenticated user with valid Snowflake credentials to perform arbitrary file read and write operations on the n8n host. This occurs because the Snowflake node passes free-form Execute Query input directly to the Snowflake SDK without enforcing n8n's file-access restrictions. The vulnerability affects multiple versions of n8n prior to 1.123.69, 2.33.4, and 2.34.1. A patch is available to address this issue.
CVE-2026-77079 is an authorization bypass vulnerability in n8n versions before 2.34.1 and 2.33.4. It affects the deletion process of custom project roles with reassignment targets, where the system fails to perform project-level authorization checks. A user with the narrow role:manageProject global scope can delete any custom project role and reassign its holders to the built-in project:admin role, thereby gaining unauthorized full administrative control over projects.
CVE-2026-77077 is a high-severity vulnerability in n8n before versions 1.123.69, 2.33.4, and 2.34.1. It involves a JavaScript task runner VM sandbox escape due to incomplete prototype freezing, allowing authenticated users with Code node access to execute arbitrary commands within the runner container. The vulnerability enables prototype pollution that persists across tenants sharing the same runner. On older v1.x instances without task runners, the impact could be more severe as code runs in the main process.
n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 have an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the error message includes sensitive information such as decrypted credential secrets in the request headers. This sensitive data is stored verbatim in the execution engine's run data, accessible to any authenticated user who can read the execution results.
n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 have an expression injection vulnerability in the resource-locator field used for link preview rendering. This flaw allows an authenticated user to inject malicious JavaScript expressions that are evaluated in the context of other users when they open the affected node in the editor, resulting in cross-user script execution.
CVE-2026-77074 is a medium severity vulnerability in n8n versions before 1.123.69 that affects the Edit Image node's Draw Text operation. Authenticated users can exploit this flaw to inject MVG primitives, enabling blind outbound HTTP requests to arbitrary addresses or access to local files. The vulnerability arises from improper control of code generation, specifically a server-side request forgery (SSRF) vector. Multiple version ranges of n8n are affected, including versions before 1.123.69 and certain 2.x releases prior to specific patch versions.
n8n versions prior to 2.34.1 contain an authorization bypass vulnerability in the MCP create_workflow_from_code tool when the authentication type is set to an expression. This flaw allows attackers with a valid MCP Bearer API key and knowledge of a target credential ID to persist unauthorized cross-project credential references on workflows across different projects. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 contain a stored cross-site scripting (XSS) vulnerability in the Form node's completion page. This vulnerability arises because the completion page applies its Content-Security-Policy sandbox only when respondWith is not set to 'redirect', but always renders responseText as raw HTML. An authenticated user can exploit this by setting respondWith to 'redirect' while keeping responseText populated, causing unsanitized HTML and scripts to be served from the n8n origin. Visitors submitting the affected public form may have malicious scripts execute in their session context.
CVE-2026-77071 is a SQL injection vulnerability in the n8n workflow automation tool affecting the Supabase node's Row Get Many, Delete, and Update operations. The flaw arises from improper neutralization of special elements in SQL commands, allowing an attacker to inject conditions that expand filters beyond intended single-row operations. This can lead to full-table data disclosure, deletion, or modification. The vulnerability affects multiple versions prior to 1.123.69, 2.33.4, and 2.34.1. It has a high severity score of 7.1. No known exploits are reported in the wild, and no vendor patch links were provided in the input data.
n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 contain a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations. The vulnerability arises because the Query parameter is parsed as JSON after expression resolution without sanitizing MongoDB operators, allowing injection of special operators like $ne or $where. This can lead to unauthorized full-collection disclosure, deletion, or other database operations.
CVE-2026-77069 is a Server-Side Request Forgery (SSRF) vulnerability in n8n before versions 1.123.69, 2.33.4, and 2.34.1. It occurs in the OAuth2 credential authorization-code-to-access-token exchange, where a separate HTTP client without SSRF protection is used. An attacker with credential-creation permissions can exploit this to send POST requests to internal addresses and receive reflected responses limited to the token exchange request's output.
n8n versions before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability due to improper validation of pathname inputs in the node-schema loader. An authenticated user with global:member privileges can exploit path traversal sequences to execute arbitrary code in the main n8n process.
CVE-2026-77083 is a prototype pollution vulnerability in the JavaScript Code node's VM sandbox of the n8n workflow automation platform. In affected versions, the sandbox does not freeze Function.prototype, allowing an authenticated user with workflow execution privileges to modify the prototype and escape the sandbox. This vulnerability requires the presence of specific allowlisted modules in the deployment configuration to complete the exploit chain. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1.
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.
n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.