n8n: N8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API…
Affects: n8n
n8n vulnerabilities
- Product
- n8n
- Vendor
- n8n
- Kind
- Workflow automation platform
Securaity has published 150 advisories for n8n: 16 Critical, 64 High, 70 Medium.
n8n is a workflow automation platform made and maintained by n8n. It connects apps and services into automated workflows, so information can move from one tool to the next without someone copying it over by hand. Those workflows can include steps that call AI models alongside the other apps in the chain. The people who usually install and run n8n are operations staff, IT staff and developers whose job involves automating work between the apps their organization relies on day to day.
Advisories
n8n: N8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST…
Affects: n8n
n8n: N8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three…
Affects: n8n
n8n: N8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk…
Affects: n8n
n8n: N8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow…
Affects: n8n
n8n: N8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security…
Affects: n8n
n8n: N8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS…
Affects: n8n
n8n: N8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO…
Affects: n8n
n8n: N8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0…
Affects: n8n
n8n: N8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and…
Affects: n8n
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
Affects: n8n
n8n: Credential Exfiltration via Permission Bypass
Affects: n8n
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
Affects: n8n
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
Affects: n8n
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
Affects: n8n
n8n: Stored XSS in Chat Trigger Node
Affects: n8n
n8n: Same-Origin XSS in Respond to Webhook Node
Affects: n8n
n8n: Git Node Clone and Push Operations Bypass File Sandbox
Affects: n8n
n8n: Python sandbox escape
Affects: n8n
n8n: n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
Affects: n8n
n8n: n8n Has a Source Control Pull SQL Injection
Affects: n8n
n8n: n8n Has an XML Node Prototype Pollution Patch Bypass
Affects: n8n
n8n: n8n Has an Arbitrary File Read via Git Node
Affects: n8n
n8n: HTTP Request Node Pagination Prototype Pollution to RCE
Affects: n8n
n8n: Denial of Service via ZIP decompression in webhook workflow
Affects: n8n
n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
Affects: n8n
n8n: Microsoft SQL Node Prototype Pollution
Affects: n8n
n8n: Merge Node SQL Mode Prototype Pollution
Affects: n8n
n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
Affects: n8n
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
Affects: n8n
n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
Affects: n8n
n8n: N8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook…
Affects: n8n
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
Affects: n8n
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Affects: n8n
n8n: Public API Execution Retry Authorization Bypass
Affects: n8n
n8n: Python Code Node AST Validator Bypass
Affects: n8n
n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint
Affects: n8n
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with a valid API key…
Affects: n8n
n8n: Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify…
Affects: n8n