n8n

Products

Exploited and recent CVEs

• CVE-2026-59259 Medium 6.0 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets 0.4%
• CVE-2026-59254 Medium 6.3 n8n - External Secrets Disclosure via Workflow Node Expressions 0.4%
• CVE-2026-56353 Medium 4.8 n8n - Authentication Bypass in Chat Trigger Node 0.3%
• CVE-2026-56352 Medium 6.4 n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter 0.3%
• CVE-2026-56349 Medium 6.3 n8n - Guardrail Node Bypass via Crafted Input 0.5%
• CVE-2026-58661 Medium 5.3 n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint 0.4%
• CVE-2026-56354 Medium 4.1 n8n - Cross-Site Scripting and Open Redirect in Form Node 0.2%
• CVE-2026-59257 Medium 5.3 n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation 0.6%
• CVE-2026-59253 Medium 5.3 n8n - Improper Authorization in Workflow Assignment to Folders 0.3%
• CVE-2026-56778 Medium 6.4 n8n - Authorization Bypass in Public API Execution Retry Endpoint 0.3%
• CVE-2026-56776 High 7.4 n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint 0.3%
• CVE-2026-56775 Medium 5.4 n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints 0.3%
• CVE-2026-56360 Medium 4.0 n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger 0.3%
• CVE-2026-56359 Medium 5.4 n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL 0.2%
• CVE-2025-71380 High 8.8 n8n - Arbitrary Command Execution via Execute Command Node 0.6%
• CVE-2026-56777 Medium 5.0 n8n - AST Validator Bypass in Python Code Node 0.3%
• CVE-2026-56356 Medium 5.4 n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field 0.2%
• CVE-2026-56350 Medium 6.3 n8n - SSO Enforcement Bypass via API 0.4%
• CVE-2026-56358 Medium 5.4 n8n - Stored Cross-Site Scripting in Form Trigger Node 0.2%
• CVE-2026-56351 High 8.2 n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes 0.4%
• CVE-2026-56357 Medium 4.0 n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger 0.3%
• CVE-2026-56348 Critical 9.1 n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint 0.5%