Threat Intelligence Database

n8n versions before 1.123.83 have an authorization bypass vulnerability that allows authenticated users to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. This enables attackers to access credentials from projects they do not belong to and modify static data and error-workflow dispatch of other workflows.

n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contain an authentication bypass vulnerability. This occurs because dynamic-path webhook resolution only matched requests based on the path, ignoring the server-generated unguessable identifier in the URL. As a result, unauthenticated attackers can omit this identifier and execute workflows in unrelated projects using those projects' credentials.

n8n versions before 2.41.4 and certain 2.42.x versions before 2.42.1 contain an authorization bypass vulnerability in the Agents create endpoint. This flaw allows an authenticated user with read-only Agent access to one project to supply an existing Agent ID and move that Agent into their own project, enabling them to modify the Agent's name, schema, and version without proper ownership verification.

n8n versions before 2.41.4 and versions 2.42.0 before 2.42.1 contain an incorrect authorization vulnerability. The software does not properly validate credential IDs stored in agent node parameters when an editor saves a shared workflow. This allows an editor to configure a Message an Agent node in inline mode to access the owner's credentials and potentially send decrypted secrets to an attacker-controlled destination.

CVE-2026-110849 is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.83, 2.41.4, and 2.42.1. It occurs in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. An attacker who uploads a crafted item can execute scripts in the context of the n8n origin for users who preview the item, potentially acting with their session privileges.

n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contain a prototype pollution vulnerability in the AI workflow builder. Authenticated users can create nodes named __proto__ via the API and connect them, causing pollution of the global object prototype. This disrupts the n8n instance until it is restarted.

CVE-2026-110847 is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1. The flaw exists in the Chat Trigger hosted-chat page where insufficient sanitization of customCss values allows malicious markup injection. This enables workflow authors to publish chats without requiring n8n user authentication, potentially executing scripts in the context of signed-in visitors' sessions.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 contain a signature validation bypass in the waiting-webhook endpoint. This flaw arises because validation occurs before canonicalization of an alternate node reference form, allowing attackers with a workflow execution's resume token to approve waiting executions intended for others. This can lead to unauthorized downstream actions running under the workflow owner's credentials, potentially including command execution.

CVE-2026-110845 is a high-severity code execution vulnerability in the n8n automation tool affecting versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1. The flaw exists in the Git node Log operation, which does not properly strip a repository's local git configuration before running an external program. Authenticated users with permission to configure the node can exploit this to execute arbitrary code as the n8n process user.

n8n versions before 1.123.83 have an authorization bypass vulnerability allowing shared-workflow editors to access restricted credentials by embedding them in nested or inline sub-workflows. This flaw permits attackers with editor privileges to save workflows that reference credentials they should not access, which then execute using the workflow owner's credential values.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have a vulnerability in the unauthenticated OAuth authorize endpoint that allows attackers to create unlimited client records by manipulating query strings. This leads to uncontrolled resource consumption and can fill the disk.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have a prototype pollution vulnerability in the MCP workflow-validation tool. This flaw allows an authenticated user with only workflow:read permission to manipulate shared prototypes, bypassing server-side permission checks and potentially taking over owner accounts without MFA protection.

n8n versions before 2.41.4 and 2.42.0 contain an authorization bypass vulnerability in the agent chat resume endpoint. This flaw allows authenticated project members to access and manipulate other members' private agent conversations by providing a run identifier without proper ownership verification. Exploitation can lead to unauthorized reading of private conversations and execution of tool calls within the victim's context.

An SQL injection vulnerability exists in n8n versions before 2.41.4 and in 2.42.x before 2.42.1 within the Microsoft SQL node version 1. This flaw allows unauthenticated external users to execute arbitrary SQL commands on the connected database by injecting malicious input into the Query field, which is not properly parameterized. The attack leverages untrusted input such as webhook fields bound to the Query field, potentially granting access with the stored credential's privileges.

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.

n8n versions before 2.39.6 and versions from 2.40.0 up to but not including 2.40.1 have a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can exploit this by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, allowing them to capture collaborators' session tokens and gain unauthorized access to credentials.

CVE-2026-103258 is a vulnerability in n8n versions before 2.39.6 and 2.40.0 before 2.40.1 affecting SendGrid, Freshservice, and ServiceNow nodes. It allows attackers to bypass query filters by injecting unescaped parameters, potentially exposing bulk data such as contact lists, tickets, and directory entries.

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.

n8n versions prior to 1.123.80, between 2.0.0 and 2.39.6, and between 2.40.0 and 2.40.1 have a path traversal vulnerability in the Supabase node. This flaw allows attackers to manipulate the tableId parameter without validation, potentially bypassing Row Level Security and accessing or modifying data unauthorizedly via administrative keys.