N8n
Monthly
Credential exfiltration in n8n versions before 2.41.4 and 2.42.0 before 2.42.1 allows an authenticated editor on a multi-user instance to abuse a shared workflow's 'Message an Agent' node in inline mode, causing the owner's stored credentials to be resolved and sent to an attacker-chosen destination. The flaw is an access-gated authorization bypass (CWE-863) requiring editor rights and a shared workflow that references higher-trust credentials; single-operator self-hosted deployments have limited practical exposure. No public exploit was identified at time of analysis.
Stored cross-site scripting in n8n allows an authenticated member-level user to execute arbitrary script in the n8n origin of any higher-privileged user - typically the instance owner - who opens the attacker's crafted upload in the file-preview modal. The modal re-publishes uploaded binary data as an unsandboxed, same-origin blob URL, so the injected payload runs with the victim's session context, enabling theft of session material or privileged actions within the workspace. Exploitation requires a valid member account with upload rights (PR:L) and the victim to actively open the file (UI:A); no public exploit code has been identified at time of analysis, and the flaw is patched in n8n 1.123.83, 2.41.4, and 2.42.1.
Stored cross-site scripting in n8n's Chat Trigger hosted-chat page lets an authenticated workflow author (PR:L) inject arbitrary markup through the customCss parameter, which is interpolated unsanitized into the page and executes on the n8n instance origin in the browser of any signed-in visitor who loads the published chat. The chat itself can be published without n8n user authentication, so the poisoned page is reachable by any visitor, but the impact lands only on authenticated visitors whose sessions share the instance origin. Affects n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; rated CVSS 4.0 base 7.0 (CWE-79), and no public exploit identified at time of analysis.
Authenticated code execution in n8n (before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1) is possible through the Git node's Log operation, which invokes the external git program without stripping the target repository's local git configuration first. A member-level authenticated user who can point that node - including the scenario where the Git node is exposed as an agent tool the attacker can steer - at a repository whose local config they control can smuggle configuration directives that cause git to launch arbitrary programs as the n8n process user. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.7, and the independent assessment rates it CVSS 3.1 8.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with exploitation gated on valid n8n member credentials and attacker control of the repository's local configuration.
An authorization bypass in n8n versions before 1.123.83 allows an authenticated user with editor (write) access to a shared workflow to execute restricted credentials that belong to another user, by embedding those credentials inside nested or tool inline sub-workflow definitions. When the workflow runs, the sub-workflows execute using the credential owner's secret values rather than being rejected against the attacker's own credential scope. This is a conditional privilege/authorization issue rather than a drive-by remote threat: it requires a multi-user instance with shared workflows and scoped credential sharing, an editor-level account, and the presence of at least one restricted credential owned by someone else - single-user instances and deployments without shared workflows are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue is reported as an Authentication Bypass and is fixed in n8n 1.123.83.
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Session token leakage in n8n's Dynamic Credentials authorize and revoke endpoints lets an attacker who already holds resolver-registration privileges point a fallback resolver at an attacker-controlled endpoint and capture a collaborating user's session token once that user completes the account-connection flow, yielding unauthorized credential access. Impact is access-gated rather than open: exploitation requires an authenticated, high-privileged actor plus an independent user interaction, and is realistic mainly on shared or multi-tenant n8n instances where semi-trusted users hold resolver-registration rights, not against a default single-tenant deployment reachable by an unprivileged remote attacker. Affected versions are n8n before 2.39.6 and 2.40.0 before 2.40.1; vendor-released patches exist, and neither a public proof-of-concept exploit nor confirmed active exploitation (CISA KEV) was identified at time of analysis.
Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.
Credential theft in n8n before 2.39.6 and 2.40.0 before 2.40.1 allows an authenticated user with credential-update permissions to modify the host field of Wekan or Baserow username-and-password credentials, causing unencrypted passwords to be sent to an attacker-controlled destination that bypasses n8n's domain validation. Exploitation requires that the tampered credential is actually used by a workflow, and the attacker must already hold a valid account or session with rights to edit credentials. No public exploit code was identified at time of analysis, and the vendor has released fixes in versions 2.39.6 and 2.40.1.
Path traversal in the n8n Supabase node allows unauthenticated remote attackers to pivot to Supabase Auth and Storage APIs when a workflow binds the tableId parameter to untrusted input, bypassing Row Level Security and enabling unauthorized data access and modification. Affects n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; fixed in 1.123.80, 2.39.6, and 2.40.1. No public exploit identified at time of analysis. Exploitation requires the Supabase credential to use the administrative serviceRole key and a workflow with a dynamic tableId - a victim-side configuration dependency that is the primary limiting factor, consistent with the assessed attack requirement (AT:P) and high attack complexity (AC:H).
Cross-project approval forgery in n8n's Send-and-Wait approval feature allows an authenticated attacker with workflow-creation permissions to mint valid signed resume URLs for approval gates in projects they cannot access by supplying caller-controlled node IDs that contain unresolved path-traversal sequences. Affected releases are n8n before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1; the issue is meaningful primarily in multi-project or multi-tenant deployments where project isolation is relied upon as a security boundary. The independent assessment rates this as a genuine but moderate-severity issue with low likelihood of mass exploitation; no public exploit identified at time of analysis, and vendor patches are available.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass in the n8n workflow automation platform lets an authenticated, low-privileged user exfiltrate project-scoped variables by supplying an arbitrary project ID to the credential test endpoint, which resolves those variables without validating that the caller may access the referenced project. The interpolated secrets are then embedded into the outbound credential test request, which the attacker directs at a host they control, turning a legitimate diagnostics feature into a data-exfiltration channel. All deployments on versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 are affected, with cross-project isolation loss being most consequential in multi-project or multi-tenant instances; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
n8n deployments running in queue mode can have arbitrary npm packages installed across every cluster worker by an attacker who holds write access to the deployment's Redis instance, bypassing package name validation, permission checks, checksum verification, and npm safety checks in the community-package installation handler. Affected builds are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; vendor fixes ship in 1.123.80, 2.39.6, and 2.40.1. No public exploit code has been identified at time of analysis, and practical risk is gated by the network-position prerequisite - the attacker must already be inside the Redis trust boundary - with single-instance 'main' mode deployments unaffected.
Unauthenticated remote attackers can exploit NoSQL injection in the n8n MongoDB Chat Memory node to bypass sessionId validation and read or manipulate stored conversation histories belonging to other users, rated CVSS 4.0 base 7.0 (network-reachable, low complexity, PR:N) and assessed by us as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The exposure is conditional rather than default: exploitation requires a target instance to run a workflow that uses the MongoDB Chat Memory node and to have its sessionId-handling path reachable (the CVSS 4.0 AT:P attack requirement), so installations that never use that node are unaffected, and the real-world impact depends on the sensitivity of the conversation content stored. Patch is available from the vendor in n8n 1.123.80, 2.39.6 and 2.40.1, and no public exploit code has been identified at time of analysis.
Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.
n8n automation instances running versions before 2.39.6 or 2.40.0 before 2.40.1 permit an authenticated attacker with low privileges to decrypt and exfiltrate stored plaintext credentials by referencing arbitrary credential IDs during inline AI agent node-tool introspection, which fails to verify credential ownership (CWE-639). Successful exploitation yields high confidentiality impact with a scope change (CVSS 3.1 base 8.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attacker must hold a valid account able to build or edit workflows, know or enumerate internal credential IDs, and operate an attacker-controlled host to receive the secrets. No public exploit identified at time of analysis, and vendor patches are available as 2.39.6 and 2.40.1.
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. The vulnerability is confined to the legacy expression engine (isolated-vm-bridge.ts and ExpressionBuilder.ts); the vm expression engine is unaffected. No public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's OpenAI Chat Model node allows an authenticated workflow editor to redirect the model-search dropdown request - including the attached OpenAI API key - to an arbitrary attacker-controlled host by overriding `options.baseURL`. Affected versions span the v1 branch prior to 1.123.76 and the v2 branch prior to 2.37.7 and 2.38.2; the root cause is the omission of `assertOpenAiCredentialAllowsUrl` in `loadModels.ts`, the same domain-restriction guard applied elsewhere in the node. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches are available across all three branches.
Remote code execution in n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 is achievable by any authenticated user who can author workflow expressions. The root cause is a sandbox escape in the PrototypeSanitizer AST hook: because the sanitizer references itself via dynamically scoped `this`, a crafted class field named `__sanitize` rebinds the sanitizer function, after which the expression freely invokes the JavaScript `Function()` constructor and executes arbitrary Node.js code on the backend. No public exploit has been identified at time of analysis, but the Function constructor escape technique is well-documented in the JavaScript security research community, lowering the barrier to independent rediscovery.
Unvalidated input sizes on the OAuth Dynamic Client Registration endpoint in n8n allow unauthenticated remote attackers to exhaust database storage by repeatedly submitting oversized client_name and grant_types values. Affected versions are all n8n releases prior to 2.37.7 (in the 2.37.x branch) and prior to 2.38.2 (in the 2.38.x branch). Because the endpoint is publicly accessible without authentication and the attack is trivially automatable, a single attacker can render the n8n instance unavailable by filling database disk capacity, taking down all workflow automation for any organization relying on the platform.
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. This bypasses n8n's credential API blank-value redaction, effectively leaking third-party service credentials to any n8n user who can inspect execution results. No public exploit or CISA KEV listing exists at time of analysis; patches are available in versions 1.123.73, 2.35.4, and 2.36.2.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's workflow execution engine allows a low-privileged authenticated user to reference another user's credentials inside an inline sub-workflow node (such as the Workflow Tool node) without any ownership validation. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. When a privileged execution context later runs the poisoned workflow and resolves the referenced secret, the sub-workflow can forward the plaintext credential to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the VulnCheck advisory corroborates the GitHub Security Advisory GHSA-4r56-g65c-fm83.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.
Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Decrypted credential secrets are exposed in execution logs in n8n workflow automation software across versions before 1.123.69, 2.33.4, and 2.34.1. The GraphQL node fails to wrap connection-level HTTP client errors in n8n's standard error type, propagating raw error objects - which carry decrypted credential headers - directly into the persistent execution record. Any authenticated user with read access to workflow execution history can recover those plaintext secrets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and direct credential exposure make this a high-priority remediation target for shared or multi-tenant deployments.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. No public exploit identified at time of analysis, but the CVSS 4.0 subsequent-system impact is rated high across confidentiality, integrity, and availability, reflecting the catastrophic downstream database risk.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Credential exfiltration in n8n's AI and LLM workflow nodes allows low-privileged users with use-only access to shared credentials to bypass the 'Allowed HTTP Request Domains' allowlist and redirect credential secrets to attacker-controlled infrastructure. Affected are all n8n npm installations before version 2.31.5 and the 2.32.0 release (fixed in 2.32.1), where at least one credential has domain restrictions configured and is shared with non-owner users. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the attack is low-complexity for any insider or compromised low-privilege account.
Path traversal in n8n's Git node before versions 1.123.67, 2.31.5, and 2.32.1 allows authenticated low-privilege users to escape the repository sandbox during fetch, pull, and push-tags operations. By pointing an allowlisted remote configuration value at a local filesystem path outside the intended sandbox, an attacker with workflow create/execute rights can pull arbitrary local git repositories into the workspace and read their files and full commit history, including any secrets or credentials stored in git history. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and low-privilege attack path make it a realistic insider or compromised-account threat in multi-user n8n deployments.
Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Credential exfiltration in n8n's workflow automation platform allows any user with Editor access to a shared workflow to bypass authorization checks and use or exfiltrate credentials they are not permitted to access. The flaw exists because n8n validates credential permissions only for a node's top-level credential references, not for credentials embedded inside an Execute Sub-workflow node's inline workflow JSON (Source = Parameter); the embedded reference passes both save-time and runtime validation and resolves using the parent workflow's project context. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects a credible, low-complexity path to high-confidentiality impact when workflow sharing is in use.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Credential disclosure in n8n workflow automation (versions prior to 1.123.61, 2.27.4, and 2.28.1) allows an authenticated member holding use-only editor access to a shared workflow to read credential-populated HTTP headers via the $request object inside an HTTP Request node's pagination expression, then exfiltrate the secret through returned item data. This defeats n8n's credential-hiding model, which is supposed to prevent low-privilege collaborators from seeing the underlying secret values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the EPSS/POC signals were not provided.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
Authentication bypass in n8n's external identity resolution lets an attacker impersonate other users when the instance trusts more than one token-exchange issuer. Affecting n8n before 2.27.4 and version 2.28.0, the flaw stems from resolving federated identities using only the JWT sub claim while ignoring the iss claim, so a valid token from one trusted issuer whose sub matches a victim registered under a different issuer grants full access to that victim's account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authentication-level impact (VC:H/VI:H) makes it a meaningful account-takeover risk for multi-issuer SSO deployments.
Credential secret exfiltration in n8n (self-hosted workflow automation) prior to 2.27.4 and 2.28.1 lets a low-privilege member with use-only access to a shared credential leak that secret to an attacker-controlled server. The AI Agents feature fails to enforce the 'Allowed HTTP Request Domains' restriction when an MCP tool is aimed at an arbitrary URL, so the guardrail meant to keep secrets in-bounds is bypassed. No public exploit identified at time of analysis; risk is elevated because the abuse comes from an already-authorized internal user rather than an outside attacker.
Authenticated users in n8n versions prior to 1.123.23 and 2.6.4 can bypass external secrets permission checks to retrieve plaintext secret values from configured vaults by referencing secrets by name in credentials, even without list permissions. This allows unauthorized access to sensitive vault-stored credentials without requiring admin or owner privileges, provided the attacker knows or can guess the target secret name. Public exploit code exists for this vulnerability.
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute arbitrary SQL queries against PostgreSQL backends, enabling data modification and deletion. Public exploit code exists for this vulnerability. Affected versions prior to 1.123.26, 2.13.3, and 2.14.1 should be upgraded immediately, or workflow creation/editing permissions should be restricted to trusted users only.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP email attribute to match a target account's email address, gaining full access that persists even after reverting the email change. This authentication bypass (CWE-287) affects n8n versions prior to 2.4.0 and 1.121.0 where LDAP is configured, and public exploit code exists. The vulnerability requires LDAP to be actively enabled and the attacker to control their own LDAP email attribute, creating a critical account takeover risk for administrators.
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated users with member-level privileges to steal plaintext credentials from other users. The flaw chains name-based credential resolution that doesn't enforce ownership with a permissions bypass affecting generic HTTP credential types (httpBasicAuth, httpHeaderAuth, httpQueryAuth). Attackers can decrypt and exfiltrate credentials without authorization, though native integration credentials remain unaffected.
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit the Merge node's 'Combine by SQL' mode to read arbitrary local files on the n8n host and achieve remote code execution. n8n versions prior to 2.14.1, 2.13.3, and 1.123.26 are affected. The vulnerability carries a CVSS 4.0 score of 9.4 (Critical) due to insufficient sandbox restrictions in the AlaSQL component, allowing SQL injection-style attacks against the host system. No public proof-of-concept or active exploitation (KEV) status has been reported at this time.
Authenticated remote code execution in n8n workflow automation platform (versions prior to 2.10.1, 2.9.3, and 1.123.22) allows low-privilege users with workflow creation or modification permissions to execute arbitrary system commands on the host. The vulnerability stems from insufficient isolation in the expression evaluation engine, where crafted expressions in workflow parameters can break out of the intended sandbox. Patches are available, no active exploitation has been reported, and the EPSS score of 0.15% indicates low current exploitation probability despite the critical CVSS rating.
Remote code execution in n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to execute arbitrary shell commands by chaining file write operations with git functions to manipulate configuration files. Versions prior to 2.2.0 and 1.123.8 are affected, and administrators should upgrade immediately or restrict workflow editing permissions to trusted users only.
Authenticated users with workflow modification permissions in n8n versions prior to 2.10.1, 2.9.3, and 1.123.22 can exploit the Merge node's SQL query mode to execute arbitrary code and write files on the server. This high-severity vulnerability (CVSS 8.8) affects the AI/ML and workflow automation platform, allowing attackers with legitimate access to achieve complete system compromise. No patch is currently available, and administrators should restrict workflow permissions or disable the Merge node as temporary mitigations.
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary code by creating or editing workflows with malicious expressions. Third n8n RCE CVE in this release.
Python sandbox escape in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Users who can modify workflows can escape the Python Code node sandbox for full host compromise on instances using internal Task Runners.
Second-order expression injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Crafted workflow data triggers expression evaluation leading to code execution. Patch available.
n8n versions 0.187.0 through 1.120.2 contain a command injection vulnerability in the community package installation feature that allows authenticated administrators to execute arbitrary system commands on the host. The vulnerability requires high privilege access and specific conditions to exploit but carries high risk due to potential complete system compromise. A patch is available in version 1.120.3.
n8n has a protection mechanism bypass (CVSS 9.9) in the Python sandbox allowing authenticated users to escape code execution restrictions.
N8N versions up to 1.118.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
n8n is an open source workflow automation platform. [CVSS 8.1 HIGH]
n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.
n8n has a TOCTOU race condition vulnerability (CVSS 9.9) enabling bypass of execution restrictions in workflow processing.
n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through crafted workflow expressions.
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox restrictions and execute arbitrary code on the underlying operating system, with full instance takeover possible in Internal execution mode. Public exploit code exists for this vulnerability, which affects n8n deployments running under Internal execution mode where the Python executor has direct OS access. External execution mode deployments using Docker sidecars have reduced impact as code execution is confined to the container rather than the main node.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with scope change enabling full compromise of both self-hosted and cloud instances. EPSS 12.5% indicates high exploitation activity. Patch available.
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical CVSS 10.0 vulnerability enabling remote attackers to read sensitive files from the server, with potential for further compromise. PoC available.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation or editing rights to escape the JavaScript sandbox and run arbitrary code with the privileges of the n8n process, affecting versions from 0.211.0 up to (but not including) 1.120.4, 1.121.1, and 1.122.0. The issue is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, with security research tying exploitation to Zerobot malware campaigns targeting exposed n8n deployments. Successful abuse gives full compromise of the instance: theft of secrets and workflow data, unauthorized workflow modification, and system-level command execution on the host.
Unauthenticated attackers can execute workflows belonging to unrelated projects on n8n instances by omitting the server-generated identifier from requests to dynamic-path webhook, form, or MCP routes, which the platform resolves on the path component alone. The flaw affects n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1, and exploitation requires no credentials or user interaction - only network reachability and an instance that has at least one deployed dynamic-path trigger configured. Impact is bounded to the workflows and stored credentials of the affected projects (assessed CVSS 3.1 6.3, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis, though the omission technique is trivial to attempt and vendor advisories are public.
Cross-project Agent ownership transfer in n8n allows an authenticated user who holds only read-only Agent access to a victim project to seize and rewrite that project's Agents by supplying a foreign Agent ID to the Agents create endpoint. Affected are n8n versions before 2.41.4 and 2.42.x releases before 2.42.1; this is an IDOR-class authorization bypass (CWE-639) carrying a CVSS 4.0 base score of 6.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L, i.e. a medium-severity integrity-focused flaw rather than a pre-auth remote code execution issue. Exploitation requires a valid authenticated account, pre-existing read-only Agent visibility into the target project, and knowledge or possession of a valid Agent ID belonging to that project, so it cannot be mounted by an unauthenticated external attacker against a default install; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authorization bypass in n8n's agent chat resume endpoint allows an authenticated member of a shared n8n project to read other members' private agent conversations and approve their pending tool calls, causing those tools to execute and write results back into the victim's conversation. The flaw affects n8n releases before 2.41.4 and 2.42.0 and is rooted in an insecure direct object reference (CWE-639): the resume endpoint accepts a run identifier from the request body without verifying that the referenced suspended checkpoint belongs to the caller. Exploitation requires a valid project-member account (PR:L) plus the stateful condition that another user's agent-chat checkpoint is currently suspended and awaiting tool-call approval (AT:P), so this is primarily a multi-tenant or shared-project insider risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed severity is moderate (CVSS 3.1 base 6.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Unauthenticated attackers can advance suspended n8n workflow executions by submitting resume requests that the Send and Wait node in 'Approve Within Chat' mode accepts without verifying the requester's identity or approval permissions. Affected are n8n releases before 2.39.6 and 2.40.0 releases before 2.40.1; exploitation is only possible when a workflow is actively paused at such an approval node, and the resulting impact is integrity-only, limited to advancing that execution and any actions it guards. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue; vendor patches are available in 2.39.6 and 2.40.1.
Filter bypass in the SendGrid, Freshservice, and ServiceNow nodes of n8n (versions before 2.39.6 and 2.40.0 before 2.40.1) lets unescaped parameter interpolation break out of query literals and widen single-record lookups into match-all queries, exposing bulk data such as contact lists, tickets, and directory entries on the connected third-party service. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but conditional: the workflow must actually use one of the three affected nodes and bind a vulnerable lookup/filter parameter to untrusted external input, which is reflected in the AT:P attack-requirement rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; impact is bounded to bulk read exposure of third-party data, not compromise of the n8n host itself, and a vendor-released patch is available.
Stored DOM cross-site scripting in the n8n workflow automation platform affects all releases before 1.123.80 on the 1.x line, 2.0.0 up to but not including 2.39.6, and 2.40.0 up to but not including 2.40.1. An authenticated user with workflow-authoring privileges can store a malicious script URL inside a node's Resource Locator parameter dropdown; when another user opens that node's dropdown and clicks the external-link icon, the injected JavaScript executes in the n8n editor origin. Because the payload is embedded in the workflow definition, it survives workflow imports and shares, allowing one poisoned workflow to reach multiple victims over time - though the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) makes clear that a second, distinct user must actively click the link, so passive viewing is insufficient and single-user instances face minimal exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the vendor has released patches, so this is a conditional mid-tier priority rather than an emergency.
Credential exfiltration in n8n versions before 2.41.4 and 2.42.0 before 2.42.1 allows an authenticated editor on a multi-user instance to abuse a shared workflow's 'Message an Agent' node in inline mode, causing the owner's stored credentials to be resolved and sent to an attacker-chosen destination. The flaw is an access-gated authorization bypass (CWE-863) requiring editor rights and a shared workflow that references higher-trust credentials; single-operator self-hosted deployments have limited practical exposure. No public exploit was identified at time of analysis.
Stored cross-site scripting in n8n allows an authenticated member-level user to execute arbitrary script in the n8n origin of any higher-privileged user - typically the instance owner - who opens the attacker's crafted upload in the file-preview modal. The modal re-publishes uploaded binary data as an unsandboxed, same-origin blob URL, so the injected payload runs with the victim's session context, enabling theft of session material or privileged actions within the workspace. Exploitation requires a valid member account with upload rights (PR:L) and the victim to actively open the file (UI:A); no public exploit code has been identified at time of analysis, and the flaw is patched in n8n 1.123.83, 2.41.4, and 2.42.1.
Stored cross-site scripting in n8n's Chat Trigger hosted-chat page lets an authenticated workflow author (PR:L) inject arbitrary markup through the customCss parameter, which is interpolated unsanitized into the page and executes on the n8n instance origin in the browser of any signed-in visitor who loads the published chat. The chat itself can be published without n8n user authentication, so the poisoned page is reachable by any visitor, but the impact lands only on authenticated visitors whose sessions share the instance origin. Affects n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; rated CVSS 4.0 base 7.0 (CWE-79), and no public exploit identified at time of analysis.
Authenticated code execution in n8n (before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1) is possible through the Git node's Log operation, which invokes the external git program without stripping the target repository's local git configuration first. A member-level authenticated user who can point that node - including the scenario where the Git node is exposed as an agent tool the attacker can steer - at a repository whose local config they control can smuggle configuration directives that cause git to launch arbitrary programs as the n8n process user. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.7, and the independent assessment rates it CVSS 3.1 8.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with exploitation gated on valid n8n member credentials and attacker control of the repository's local configuration.
An authorization bypass in n8n versions before 1.123.83 allows an authenticated user with editor (write) access to a shared workflow to execute restricted credentials that belong to another user, by embedding those credentials inside nested or tool inline sub-workflow definitions. When the workflow runs, the sub-workflows execute using the credential owner's secret values rather than being rejected against the attacker's own credential scope. This is a conditional privilege/authorization issue rather than a drive-by remote threat: it requires a multi-user instance with shared workflows and scoped credential sharing, an editor-level account, and the presence of at least one restricted credential owned by someone else - single-user instances and deployments without shared workflows are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue is reported as an Authentication Bypass and is fixed in n8n 1.123.83.
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Session token leakage in n8n's Dynamic Credentials authorize and revoke endpoints lets an attacker who already holds resolver-registration privileges point a fallback resolver at an attacker-controlled endpoint and capture a collaborating user's session token once that user completes the account-connection flow, yielding unauthorized credential access. Impact is access-gated rather than open: exploitation requires an authenticated, high-privileged actor plus an independent user interaction, and is realistic mainly on shared or multi-tenant n8n instances where semi-trusted users hold resolver-registration rights, not against a default single-tenant deployment reachable by an unprivileged remote attacker. Affected versions are n8n before 2.39.6 and 2.40.0 before 2.40.1; vendor-released patches exist, and neither a public proof-of-concept exploit nor confirmed active exploitation (CISA KEV) was identified at time of analysis.
Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.
Credential theft in n8n before 2.39.6 and 2.40.0 before 2.40.1 allows an authenticated user with credential-update permissions to modify the host field of Wekan or Baserow username-and-password credentials, causing unencrypted passwords to be sent to an attacker-controlled destination that bypasses n8n's domain validation. Exploitation requires that the tampered credential is actually used by a workflow, and the attacker must already hold a valid account or session with rights to edit credentials. No public exploit code was identified at time of analysis, and the vendor has released fixes in versions 2.39.6 and 2.40.1.
Path traversal in the n8n Supabase node allows unauthenticated remote attackers to pivot to Supabase Auth and Storage APIs when a workflow binds the tableId parameter to untrusted input, bypassing Row Level Security and enabling unauthorized data access and modification. Affects n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; fixed in 1.123.80, 2.39.6, and 2.40.1. No public exploit identified at time of analysis. Exploitation requires the Supabase credential to use the administrative serviceRole key and a workflow with a dynamic tableId - a victim-side configuration dependency that is the primary limiting factor, consistent with the assessed attack requirement (AT:P) and high attack complexity (AC:H).
Cross-project approval forgery in n8n's Send-and-Wait approval feature allows an authenticated attacker with workflow-creation permissions to mint valid signed resume URLs for approval gates in projects they cannot access by supplying caller-controlled node IDs that contain unresolved path-traversal sequences. Affected releases are n8n before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1; the issue is meaningful primarily in multi-project or multi-tenant deployments where project isolation is relied upon as a security boundary. The independent assessment rates this as a genuine but moderate-severity issue with low likelihood of mass exploitation; no public exploit identified at time of analysis, and vendor patches are available.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass in the n8n workflow automation platform lets an authenticated, low-privileged user exfiltrate project-scoped variables by supplying an arbitrary project ID to the credential test endpoint, which resolves those variables without validating that the caller may access the referenced project. The interpolated secrets are then embedded into the outbound credential test request, which the attacker directs at a host they control, turning a legitimate diagnostics feature into a data-exfiltration channel. All deployments on versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 are affected, with cross-project isolation loss being most consequential in multi-project or multi-tenant instances; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
n8n deployments running in queue mode can have arbitrary npm packages installed across every cluster worker by an attacker who holds write access to the deployment's Redis instance, bypassing package name validation, permission checks, checksum verification, and npm safety checks in the community-package installation handler. Affected builds are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; vendor fixes ship in 1.123.80, 2.39.6, and 2.40.1. No public exploit code has been identified at time of analysis, and practical risk is gated by the network-position prerequisite - the attacker must already be inside the Redis trust boundary - with single-instance 'main' mode deployments unaffected.
Unauthenticated remote attackers can exploit NoSQL injection in the n8n MongoDB Chat Memory node to bypass sessionId validation and read or manipulate stored conversation histories belonging to other users, rated CVSS 4.0 base 7.0 (network-reachable, low complexity, PR:N) and assessed by us as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The exposure is conditional rather than default: exploitation requires a target instance to run a workflow that uses the MongoDB Chat Memory node and to have its sessionId-handling path reachable (the CVSS 4.0 AT:P attack requirement), so installations that never use that node are unaffected, and the real-world impact depends on the sensitivity of the conversation content stored. Patch is available from the vendor in n8n 1.123.80, 2.39.6 and 2.40.1, and no public exploit code has been identified at time of analysis.
Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.
n8n automation instances running versions before 2.39.6 or 2.40.0 before 2.40.1 permit an authenticated attacker with low privileges to decrypt and exfiltrate stored plaintext credentials by referencing arbitrary credential IDs during inline AI agent node-tool introspection, which fails to verify credential ownership (CWE-639). Successful exploitation yields high confidentiality impact with a scope change (CVSS 3.1 base 8.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attacker must hold a valid account able to build or edit workflows, know or enumerate internal credential IDs, and operate an attacker-controlled host to receive the secrets. No public exploit identified at time of analysis, and vendor patches are available as 2.39.6 and 2.40.1.
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. The vulnerability is confined to the legacy expression engine (isolated-vm-bridge.ts and ExpressionBuilder.ts); the vm expression engine is unaffected. No public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's OpenAI Chat Model node allows an authenticated workflow editor to redirect the model-search dropdown request - including the attached OpenAI API key - to an arbitrary attacker-controlled host by overriding `options.baseURL`. Affected versions span the v1 branch prior to 1.123.76 and the v2 branch prior to 2.37.7 and 2.38.2; the root cause is the omission of `assertOpenAiCredentialAllowsUrl` in `loadModels.ts`, the same domain-restriction guard applied elsewhere in the node. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches are available across all three branches.
Remote code execution in n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 is achievable by any authenticated user who can author workflow expressions. The root cause is a sandbox escape in the PrototypeSanitizer AST hook: because the sanitizer references itself via dynamically scoped `this`, a crafted class field named `__sanitize` rebinds the sanitizer function, after which the expression freely invokes the JavaScript `Function()` constructor and executes arbitrary Node.js code on the backend. No public exploit has been identified at time of analysis, but the Function constructor escape technique is well-documented in the JavaScript security research community, lowering the barrier to independent rediscovery.
Unvalidated input sizes on the OAuth Dynamic Client Registration endpoint in n8n allow unauthenticated remote attackers to exhaust database storage by repeatedly submitting oversized client_name and grant_types values. Affected versions are all n8n releases prior to 2.37.7 (in the 2.37.x branch) and prior to 2.38.2 (in the 2.38.x branch). Because the endpoint is publicly accessible without authentication and the attack is trivially automatable, a single attacker can render the n8n instance unavailable by filling database disk capacity, taking down all workflow automation for any organization relying on the platform.
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. This bypasses n8n's credential API blank-value redaction, effectively leaking third-party service credentials to any n8n user who can inspect execution results. No public exploit or CISA KEV listing exists at time of analysis; patches are available in versions 1.123.73, 2.35.4, and 2.36.2.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's workflow execution engine allows a low-privileged authenticated user to reference another user's credentials inside an inline sub-workflow node (such as the Workflow Tool node) without any ownership validation. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. When a privileged execution context later runs the poisoned workflow and resolves the referenced secret, the sub-workflow can forward the plaintext credential to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the VulnCheck advisory corroborates the GitHub Security Advisory GHSA-4r56-g65c-fm83.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.
Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Decrypted credential secrets are exposed in execution logs in n8n workflow automation software across versions before 1.123.69, 2.33.4, and 2.34.1. The GraphQL node fails to wrap connection-level HTTP client errors in n8n's standard error type, propagating raw error objects - which carry decrypted credential headers - directly into the persistent execution record. Any authenticated user with read access to workflow execution history can recover those plaintext secrets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and direct credential exposure make this a high-priority remediation target for shared or multi-tenant deployments.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. No public exploit identified at time of analysis, but the CVSS 4.0 subsequent-system impact is rated high across confidentiality, integrity, and availability, reflecting the catastrophic downstream database risk.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Credential exfiltration in n8n's AI and LLM workflow nodes allows low-privileged users with use-only access to shared credentials to bypass the 'Allowed HTTP Request Domains' allowlist and redirect credential secrets to attacker-controlled infrastructure. Affected are all n8n npm installations before version 2.31.5 and the 2.32.0 release (fixed in 2.32.1), where at least one credential has domain restrictions configured and is shared with non-owner users. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the attack is low-complexity for any insider or compromised low-privilege account.
Path traversal in n8n's Git node before versions 1.123.67, 2.31.5, and 2.32.1 allows authenticated low-privilege users to escape the repository sandbox during fetch, pull, and push-tags operations. By pointing an allowlisted remote configuration value at a local filesystem path outside the intended sandbox, an attacker with workflow create/execute rights can pull arbitrary local git repositories into the workspace and read their files and full commit history, including any secrets or credentials stored in git history. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and low-privilege attack path make it a realistic insider or compromised-account threat in multi-user n8n deployments.
Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Credential exfiltration in n8n's workflow automation platform allows any user with Editor access to a shared workflow to bypass authorization checks and use or exfiltrate credentials they are not permitted to access. The flaw exists because n8n validates credential permissions only for a node's top-level credential references, not for credentials embedded inside an Execute Sub-workflow node's inline workflow JSON (Source = Parameter); the embedded reference passes both save-time and runtime validation and resolves using the parent workflow's project context. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects a credible, low-complexity path to high-confidentiality impact when workflow sharing is in use.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Credential disclosure in n8n workflow automation (versions prior to 1.123.61, 2.27.4, and 2.28.1) allows an authenticated member holding use-only editor access to a shared workflow to read credential-populated HTTP headers via the $request object inside an HTTP Request node's pagination expression, then exfiltrate the secret through returned item data. This defeats n8n's credential-hiding model, which is supposed to prevent low-privilege collaborators from seeing the underlying secret values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the EPSS/POC signals were not provided.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
Authentication bypass in n8n's external identity resolution lets an attacker impersonate other users when the instance trusts more than one token-exchange issuer. Affecting n8n before 2.27.4 and version 2.28.0, the flaw stems from resolving federated identities using only the JWT sub claim while ignoring the iss claim, so a valid token from one trusted issuer whose sub matches a victim registered under a different issuer grants full access to that victim's account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authentication-level impact (VC:H/VI:H) makes it a meaningful account-takeover risk for multi-issuer SSO deployments.
Credential secret exfiltration in n8n (self-hosted workflow automation) prior to 2.27.4 and 2.28.1 lets a low-privilege member with use-only access to a shared credential leak that secret to an attacker-controlled server. The AI Agents feature fails to enforce the 'Allowed HTTP Request Domains' restriction when an MCP tool is aimed at an arbitrary URL, so the guardrail meant to keep secrets in-bounds is bypassed. No public exploit identified at time of analysis; risk is elevated because the abuse comes from an already-authorized internal user rather than an outside attacker.
Authenticated users in n8n versions prior to 1.123.23 and 2.6.4 can bypass external secrets permission checks to retrieve plaintext secret values from configured vaults by referencing secrets by name in credentials, even without list permissions. This allows unauthorized access to sensitive vault-stored credentials without requiring admin or owner privileges, provided the attacker knows or can guess the target secret name. Public exploit code exists for this vulnerability.
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute arbitrary SQL queries against PostgreSQL backends, enabling data modification and deletion. Public exploit code exists for this vulnerability. Affected versions prior to 1.123.26, 2.13.3, and 2.14.1 should be upgraded immediately, or workflow creation/editing permissions should be restricted to trusted users only.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP email attribute to match a target account's email address, gaining full access that persists even after reverting the email change. This authentication bypass (CWE-287) affects n8n versions prior to 2.4.0 and 1.121.0 where LDAP is configured, and public exploit code exists. The vulnerability requires LDAP to be actively enabled and the attacker to control their own LDAP email attribute, creating a critical account takeover risk for administrators.
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated users with member-level privileges to steal plaintext credentials from other users. The flaw chains name-based credential resolution that doesn't enforce ownership with a permissions bypass affecting generic HTTP credential types (httpBasicAuth, httpHeaderAuth, httpQueryAuth). Attackers can decrypt and exfiltrate credentials without authorization, though native integration credentials remain unaffected.
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit the Merge node's 'Combine by SQL' mode to read arbitrary local files on the n8n host and achieve remote code execution. n8n versions prior to 2.14.1, 2.13.3, and 1.123.26 are affected. The vulnerability carries a CVSS 4.0 score of 9.4 (Critical) due to insufficient sandbox restrictions in the AlaSQL component, allowing SQL injection-style attacks against the host system. No public proof-of-concept or active exploitation (KEV) status has been reported at this time.
Authenticated remote code execution in n8n workflow automation platform (versions prior to 2.10.1, 2.9.3, and 1.123.22) allows low-privilege users with workflow creation or modification permissions to execute arbitrary system commands on the host. The vulnerability stems from insufficient isolation in the expression evaluation engine, where crafted expressions in workflow parameters can break out of the intended sandbox. Patches are available, no active exploitation has been reported, and the EPSS score of 0.15% indicates low current exploitation probability despite the critical CVSS rating.
Remote code execution in n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to execute arbitrary shell commands by chaining file write operations with git functions to manipulate configuration files. Versions prior to 2.2.0 and 1.123.8 are affected, and administrators should upgrade immediately or restrict workflow editing permissions to trusted users only.
Authenticated users with workflow modification permissions in n8n versions prior to 2.10.1, 2.9.3, and 1.123.22 can exploit the Merge node's SQL query mode to execute arbitrary code and write files on the server. This high-severity vulnerability (CVSS 8.8) affects the AI/ML and workflow automation platform, allowing attackers with legitimate access to achieve complete system compromise. No patch is currently available, and administrators should restrict workflow permissions or disable the Merge node as temporary mitigations.
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary code by creating or editing workflows with malicious expressions. Third n8n RCE CVE in this release.
Python sandbox escape in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Users who can modify workflows can escape the Python Code node sandbox for full host compromise on instances using internal Task Runners.
Second-order expression injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Crafted workflow data triggers expression evaluation leading to code execution. Patch available.
n8n versions 0.187.0 through 1.120.2 contain a command injection vulnerability in the community package installation feature that allows authenticated administrators to execute arbitrary system commands on the host. The vulnerability requires high privilege access and specific conditions to exploit but carries high risk due to potential complete system compromise. A patch is available in version 1.120.3.
n8n has a protection mechanism bypass (CVSS 9.9) in the Python sandbox allowing authenticated users to escape code execution restrictions.
N8N versions up to 1.118.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
n8n is an open source workflow automation platform. [CVSS 8.1 HIGH]
n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.
n8n has a TOCTOU race condition vulnerability (CVSS 9.9) enabling bypass of execution restrictions in workflow processing.
n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through crafted workflow expressions.
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox restrictions and execute arbitrary code on the underlying operating system, with full instance takeover possible in Internal execution mode. Public exploit code exists for this vulnerability, which affects n8n deployments running under Internal execution mode where the Python executor has direct OS access. External execution mode deployments using Docker sidecars have reduced impact as code execution is confined to the container rather than the main node.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with scope change enabling full compromise of both self-hosted and cloud instances. EPSS 12.5% indicates high exploitation activity. Patch available.
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical CVSS 10.0 vulnerability enabling remote attackers to read sensitive files from the server, with potential for further compromise. PoC available.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation or editing rights to escape the JavaScript sandbox and run arbitrary code with the privileges of the n8n process, affecting versions from 0.211.0 up to (but not including) 1.120.4, 1.121.1, and 1.122.0. The issue is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, with security research tying exploitation to Zerobot malware campaigns targeting exposed n8n deployments. Successful abuse gives full compromise of the instance: theft of secrets and workflow data, unauthorized workflow modification, and system-level command execution on the host.
Unauthenticated attackers can execute workflows belonging to unrelated projects on n8n instances by omitting the server-generated identifier from requests to dynamic-path webhook, form, or MCP routes, which the platform resolves on the path component alone. The flaw affects n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1, and exploitation requires no credentials or user interaction - only network reachability and an instance that has at least one deployed dynamic-path trigger configured. Impact is bounded to the workflows and stored credentials of the affected projects (assessed CVSS 3.1 6.3, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis, though the omission technique is trivial to attempt and vendor advisories are public.
Cross-project Agent ownership transfer in n8n allows an authenticated user who holds only read-only Agent access to a victim project to seize and rewrite that project's Agents by supplying a foreign Agent ID to the Agents create endpoint. Affected are n8n versions before 2.41.4 and 2.42.x releases before 2.42.1; this is an IDOR-class authorization bypass (CWE-639) carrying a CVSS 4.0 base score of 6.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L, i.e. a medium-severity integrity-focused flaw rather than a pre-auth remote code execution issue. Exploitation requires a valid authenticated account, pre-existing read-only Agent visibility into the target project, and knowledge or possession of a valid Agent ID belonging to that project, so it cannot be mounted by an unauthenticated external attacker against a default install; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authorization bypass in n8n's agent chat resume endpoint allows an authenticated member of a shared n8n project to read other members' private agent conversations and approve their pending tool calls, causing those tools to execute and write results back into the victim's conversation. The flaw affects n8n releases before 2.41.4 and 2.42.0 and is rooted in an insecure direct object reference (CWE-639): the resume endpoint accepts a run identifier from the request body without verifying that the referenced suspended checkpoint belongs to the caller. Exploitation requires a valid project-member account (PR:L) plus the stateful condition that another user's agent-chat checkpoint is currently suspended and awaiting tool-call approval (AT:P), so this is primarily a multi-tenant or shared-project insider risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed severity is moderate (CVSS 3.1 base 6.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Unauthenticated attackers can advance suspended n8n workflow executions by submitting resume requests that the Send and Wait node in 'Approve Within Chat' mode accepts without verifying the requester's identity or approval permissions. Affected are n8n releases before 2.39.6 and 2.40.0 releases before 2.40.1; exploitation is only possible when a workflow is actively paused at such an approval node, and the resulting impact is integrity-only, limited to advancing that execution and any actions it guards. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue; vendor patches are available in 2.39.6 and 2.40.1.
Filter bypass in the SendGrid, Freshservice, and ServiceNow nodes of n8n (versions before 2.39.6 and 2.40.0 before 2.40.1) lets unescaped parameter interpolation break out of query literals and widen single-record lookups into match-all queries, exposing bulk data such as contact lists, tickets, and directory entries on the connected third-party service. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but conditional: the workflow must actually use one of the three affected nodes and bind a vulnerable lookup/filter parameter to untrusted external input, which is reflected in the AT:P attack-requirement rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; impact is bounded to bulk read exposure of third-party data, not compromise of the n8n host itself, and a vendor-released patch is available.
Stored DOM cross-site scripting in the n8n workflow automation platform affects all releases before 1.123.80 on the 1.x line, 2.0.0 up to but not including 2.39.6, and 2.40.0 up to but not including 2.40.1. An authenticated user with workflow-authoring privileges can store a malicious script URL inside a node's Resource Locator parameter dropdown; when another user opens that node's dropdown and clicks the external-link icon, the injected JavaScript executes in the n8n editor origin. Because the payload is embedded in the workflow definition, it survives workflow imports and shares, allowing one poisoned workflow to reach multiple victims over time - though the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) makes clear that a second, distinct user must actively click the link, so passive viewing is insufficient and single-user instances face minimal exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the vendor has released patches, so this is a conditional mid-tier priority rather than an emergency.