Nn8n-io

Products

Exploited and recent CVEs

• CVE-2025-68613 Critical 10.0 Exploited n8n Vulnerable to Remote Code Execution via Expression Injection 99.0%
• CVE-2026-119557 Medium 5.9 n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node 0.5%
• CVE-2026-119408 High 8.8 n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes 0.6%
• CVE-2026-118679 High 7.5 n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger 0.3%
• CVE-2026-118678 High 7.1 n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction 0.3%
• CVE-2026-118677 Medium 5.9 n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance 0.2%
• CVE-2026-118676 High 7.1 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass 0.2%
• CVE-2026-118675 High 7.1 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow 0.2%
• CVE-2026-118649 High 8.3 n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables 0.3%
• CVE-2026-118648 High 7.3 n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy 0.3%
• CVE-2026-118647 High 8.2 n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data 0.3%
• CVE-2026-118646 Medium 6.5 n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node 0.2%
• CVE-2026-118645 High 8.7 n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter 0.2%
• CVE-2026-118644 High 7.7 n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance 0.2%
• CVE-2026-118643 High 8.2 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data 0.3%
• CVE-2026-118642 High 7.1 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows 0.2%
• CVE-2026-118641 High 7.5 n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes 0.3%
• CVE-2026-118640 Medium 5.4 n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass 0.2%
• CVE-2026-110853 High 7.1 n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON 0.2%
• CVE-2026-110852 Medium 6.3 n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution 0.4%
• CVE-2026-110851 Medium 6.1 n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint 0.2%
• CVE-2026-110850 High 7.2 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters 0.2%
• CVE-2026-110849 High 7.2 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview 0.2%
• CVE-2026-110848 Medium 6.0 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge 0.3%
• CVE-2026-110847 High 7.0 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter 0.4%
• CVE-2026-110846 High 7.0 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook 0.5%
• CVE-2026-110845 High 7.7 n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation 0.3%
• CVE-2026-110844 High 7.2 n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows 0.3%
• CVE-2026-110843 High 8.2 n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint 0.3%
• CVE-2026-110842 High 7.7 n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter 0.3%