A prototype pollution vulnerability exists in n8n versions before 2.41.4 and in 2.42.x versions before 2.42.1. This flaw allows low-privileged users to manipulate built-in object behavior by saving workflows with specially crafted connection keys such as __proto__. The vulnerability causes server errors during the periodic history compaction task, leading to login failures and write operation disruptions.
n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contain an authentication bypass vulnerability. This occurs because dynamic-path webhook resolution only matched requests based on the path, ignoring the server-generated unguessable identifier in the URL. As a result, unauthenticated attackers can omit this identifier and execute workflows in unrelated projects using those projects' credentials.
n8n versions before 2.41.4 and versions 2.42.0 before 2.42.1 contain an incorrect authorization vulnerability. The software does not properly validate credential IDs stored in agent node parameters when an editor saves a shared workflow. This allows an editor to configure a Message an Agent node in inline mode to access the owner's credentials and potentially send decrypted secrets to an attacker-controlled destination.
CVE-2026-110849 is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.83, 2.41.4, and 2.42.1. It occurs in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. An attacker who uploads a crafted item can execute scripts in the context of the n8n origin for users who preview the item, potentially acting with their session privileges.
n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contain a prototype pollution vulnerability in the AI workflow builder. Authenticated users can create nodes named __proto__ via the API and connect them, causing pollution of the global object prototype. This disrupts the n8n instance until it is restarted.
CVE-2026-110847 is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1. The flaw exists in the Chat Trigger hosted-chat page where insufficient sanitization of customCss values allows malicious markup injection. This enables workflow authors to publish chats without requiring n8n user authentication, potentially executing scripts in the context of signed-in visitors' sessions.
n8n versions before 2.41.4 and 2.42.0 contain an authorization bypass vulnerability in the agent chat resume endpoint. This flaw allows authenticated project members to access and manipulate other members' private agent conversations by providing a run identifier without proper ownership verification. Exploitation can lead to unauthorized reading of private conversations and execution of tool calls within the victim's context.
CVE-2026-103258 is a vulnerability in n8n versions before 2.39.6 and 2.40.0 before 2.40.1 affecting SendGrid, Freshservice, and ServiceNow nodes. It allows attackers to bypass query filters by injecting unescaped parameters, potentially exposing bulk data such as contact lists, tickets, and directory entries.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
CVE-2026-103254 is a path traversal vulnerability in n8n affecting versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. The flaw exists in the signed resume URL generation for Send-and-Wait approvals, allowing attackers with workflow creation permissions to forge approval URLs for projects they do not have access to by exploiting unresolved traversal sequences in node IDs. This enables cross-project approval forgery.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
CVE-2026-103251 is a high-severity vulnerability in n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. It involves a validation bypass in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass multiple security checks to install arbitrary npm packages across all cluster instances without authentication.
A NoSQL injection vulnerability exists in n8n's MongoDB Chat Memory node due to improper validation of the sessionId parameter. This affects n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. Unauthenticated attackers can exploit this flaw to access other users' conversation histories and perform unauthorized write and delete operations.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
CVE-2026-103246 is a high-severity authorization bypass vulnerability in n8n versions before 2.39.6 and versions 2.40.0 before 2.40.1. The flaw allows attackers to bypass credential ownership validation during inline agent node-tool introspection, enabling them to reference arbitrary credential IDs. This can lead to decryption and exfiltration of plaintext secrets to attacker-controlled hosts without verifying ownership.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2.
A Server-Side Request Forgery (SSRF) vulnerability exists in the n8n workflow automation platform prior to versions 2.37.7 and 2.38.2. The issue occurs in the Instance AI credential setup flow, where a credential test or verification URL is accepted without verifying that it matches the workflow node's origin. This allows attacker-controlled content to influence the URL, potentially causing authenticated requests, redirects, or probes to unintended origins. The vulnerability affects specific code handling credential URLs and is fixed in versions 2.37.7 and 2.38.2.
CVE-2026-77084 is a high-severity OS command injection vulnerability in the n8n automation tool's Git node. Versions before 1.123.69 and certain 2.x versions prior to 2.33.4/2.34.1 are affected. The vulnerability arises because the Git node executes repository-local git configuration values without proper neutralization, allowing malicious values to be executed as the n8n process user. Exploitation requires an additional file-write vulnerability to plant the malicious configuration value, as the Git node's own configuration controls do not allow direct exploitation.
CVE-2026-77080 is a high-severity vulnerability in n8n that allows an authenticated user with valid Snowflake credentials to perform arbitrary file read and write operations on the n8n host. This occurs because the Snowflake node passes free-form Execute Query input directly to the Snowflake SDK without enforcing n8n's file-access restrictions. The vulnerability affects multiple versions of n8n prior to 1.123.69, 2.33.4, and 2.34.1. A patch is available to address this issue.