Threats affecting pkg:github/n8n-io/n8n

n8n versions from 2.14.0 through 2.46.3 have a path traversal vulnerability in the Databricks node. This flaw allows unauthenticated attackers to inject unencoded resource identifiers containing ../ sequences and query strings via inputs mapped to spaceId, indexName, or filePath. Exploitation can lead to unauthorized access to arbitrary Databricks API endpoints and reading of secrets stored in credentials.

n8n versions before 1.123.85, 2.43.5, and 2.44.1 have an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can execute workflows in inline JSON mode, bypassing permission checks and potentially exfiltrating decrypted credentials to attacker-controlled servers.

n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 have an OData $filter injection vulnerability in Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes. This flaw allows attackers to inject single quotes into expression-bindable parameters, potentially exposing the entire contact list or redirecting SharePoint writes to unintended list items within the scope of stored credentials.

A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes the SeaTable Trigger node's API token to be saved in error execution data. This occurs because failed poll requests store raw request headers, exposing the API token to users who can view workflow executions but do not have credential read access.

n8n versions before 2.41.5 and 2.42.x before 2.42.2 have a vulnerability where a failed workflow's full execution context, including the identity of the user who started the run, is passed to the configured error workflow. This allows a project editor to manipulate a colleague's workflow error settings to inherit their identity upon workflow failure and access their per-user dynamic credential secrets.

n8n versions prior to 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows member users to access credentials they should not have permission to use by omitting default node parameters in workflows. Exploitation enables attackers to save and execute workflows that bypass pre-execution credential checks, resulting in decrypted credential values being sent to destinations controlled by the attacker.

A credential guard bypass vulnerability exists in n8n versions before 1.123.85, 2.43.5, and 2.44.1. This flaw allows editors of shared workflows to exploit the Execute Sub-workflow node by loading sub-workflows from URLs or local files, thereby accessing restricted credentials and obtaining their decrypted values.

n8n versions before 1.123.83 have an authorization bypass vulnerability that allows authenticated users to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. This enables attackers to access credentials from projects they do not belong to and modify static data and error-workflow dispatch of other workflows.

n8n versions before 2.41.4 and certain 2.42.x versions before 2.42.1 contain an authorization bypass vulnerability in the Agents create endpoint. This flaw allows an authenticated user with read-only Agent access to one project to supply an existing Agent ID and move that Agent into their own project, enabling them to modify the Agent's name, schema, and version without proper ownership verification.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 contain a signature validation bypass in the waiting-webhook endpoint. This flaw arises because validation occurs before canonicalization of an alternate node reference form, allowing attackers with a workflow execution's resume token to approve waiting executions intended for others. This can lead to unauthorized downstream actions running under the workflow owner's credentials, potentially including command execution.

CVE-2026-110845 is a code execution vulnerability in n8n's Git node Log operation affecting versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1. The vulnerability arises because the node fails to remove a repository's local git configuration before running an external program. Authenticated users with permission to configure the node can exploit this by pointing it to a repository with a malicious local configuration, leading to code execution as the n8n process user.

n8n versions before 1.123.83 have an authorization bypass vulnerability allowing shared-workflow editors to access restricted credentials by embedding them in nested or inline sub-workflows. This flaw permits attackers with editor privileges to save workflows that reference credentials they should not access, which then execute using the workflow owner's credential values.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have a vulnerability in the unauthenticated OAuth authorize endpoint that allows attackers to create unlimited client records by manipulating query strings. This leads to uncontrolled resource consumption and can fill the disk.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have a prototype pollution vulnerability in the MCP workflow-validation tool. This flaw allows an authenticated user with only workflow:read permission to manipulate shared prototypes, bypassing server-side permission checks and potentially taking over owner accounts without MFA protection.

An SQL injection vulnerability exists in n8n versions before 2.41.4 and in 2.42.x before 2.42.1 within the Microsoft SQL node version 1. This flaw allows unauthenticated external users to execute arbitrary SQL commands on the connected database by injecting malicious input into the Query field, which is not properly parameterized. The attack leverages untrusted input such as webhook fields bound to the Query field, potentially granting access with the stored credential's privileges.

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.

n8n versions before 2.39.6 and versions from 2.40.0 up to but not including 2.40.1 have a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can exploit this by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, allowing them to capture collaborators' session tokens and gain unauthorized access to credentials.

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.

n8n versions prior to 1.123.80, between 2.0.0 and 2.39.6, and between 2.40.0 and 2.40.1 have a path traversal vulnerability in the Supabase node. This flaw allows attackers to manipulate the tableId parameter without validation, potentially bypassing Row Level Security and accessing or modifying data unauthorizedly via administrative keys.

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.