N8N Io
Monthly
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. This bypasses n8n's credential API blank-value redaction, effectively leaking third-party service credentials to any n8n user who can inspect execution results. No public exploit or CISA KEV listing exists at time of analysis; patches are available in versions 1.123.73, 2.35.4, and 2.36.2.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's workflow execution engine allows a low-privileged authenticated user to reference another user's credentials inside an inline sub-workflow node (such as the Workflow Tool node) without any ownership validation. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. When a privileged execution context later runs the poisoned workflow and resolves the referenced secret, the sub-workflow can forward the plaintext credential to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the VulnCheck advisory corroborates the GitHub Security Advisory GHSA-4r56-g65c-fm83.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.
Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Decrypted credential secrets are exposed in execution logs in n8n workflow automation software across versions before 1.123.69, 2.33.4, and 2.34.1. The GraphQL node fails to wrap connection-level HTTP client errors in n8n's standard error type, propagating raw error objects - which carry decrypted credential headers - directly into the persistent execution record. Any authenticated user with read access to workflow execution history can recover those plaintext secrets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and direct credential exposure make this a high-priority remediation target for shared or multi-tenant deployments.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. No public exploit identified at time of analysis, but the CVSS 4.0 subsequent-system impact is rated high across confidentiality, integrity, and availability, reflecting the catastrophic downstream database risk.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Credential exfiltration in n8n's AI and LLM workflow nodes allows low-privileged users with use-only access to shared credentials to bypass the 'Allowed HTTP Request Domains' allowlist and redirect credential secrets to attacker-controlled infrastructure. Affected are all n8n npm installations before version 2.31.5 and the 2.32.0 release (fixed in 2.32.1), where at least one credential has domain restrictions configured and is shared with non-owner users. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the attack is low-complexity for any insider or compromised low-privilege account.
Path traversal in n8n's Git node before versions 1.123.67, 2.31.5, and 2.32.1 allows authenticated low-privilege users to escape the repository sandbox during fetch, pull, and push-tags operations. By pointing an allowlisted remote configuration value at a local filesystem path outside the intended sandbox, an attacker with workflow create/execute rights can pull arbitrary local git repositories into the workspace and read their files and full commit history, including any secrets or credentials stored in git history. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and low-privilege attack path make it a realistic insider or compromised-account threat in multi-user n8n deployments.
Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Credential exfiltration in n8n's workflow automation platform allows any user with Editor access to a shared workflow to bypass authorization checks and use or exfiltrate credentials they are not permitted to access. The flaw exists because n8n validates credential permissions only for a node's top-level credential references, not for credentials embedded inside an Execute Sub-workflow node's inline workflow JSON (Source = Parameter); the embedded reference passes both save-time and runtime validation and resolves using the parent workflow's project context. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects a credible, low-complexity path to high-confidentiality impact when workflow sharing is in use.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Credential disclosure in n8n workflow automation (versions prior to 1.123.61, 2.27.4, and 2.28.1) allows an authenticated member holding use-only editor access to a shared workflow to read credential-populated HTTP headers via the $request object inside an HTTP Request node's pagination expression, then exfiltrate the secret through returned item data. This defeats n8n's credential-hiding model, which is supposed to prevent low-privilege collaborators from seeing the underlying secret values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the EPSS/POC signals were not provided.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
Authentication bypass in n8n's external identity resolution lets an attacker impersonate other users when the instance trusts more than one token-exchange issuer. Affecting n8n before 2.27.4 and version 2.28.0, the flaw stems from resolving federated identities using only the JWT sub claim while ignoring the iss claim, so a valid token from one trusted issuer whose sub matches a victim registered under a different issuer grants full access to that victim's account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authentication-level impact (VC:H/VI:H) makes it a meaningful account-takeover risk for multi-issuer SSO deployments.
Credential secret exfiltration in n8n (self-hosted workflow automation) prior to 2.27.4 and 2.28.1 lets a low-privilege member with use-only access to a shared credential leak that secret to an attacker-controlled server. The AI Agents feature fails to enforce the 'Allowed HTTP Request Domains' restriction when an MCP tool is aimed at an arbitrary URL, so the guardrail meant to keep secrets in-bounds is bypassed. No public exploit identified at time of analysis; risk is elevated because the abuse comes from an already-authorized internal user rather than an outside attacker.
Authenticated users in n8n versions prior to 1.123.23 and 2.6.4 can bypass external secrets permission checks to retrieve plaintext secret values from configured vaults by referencing secrets by name in credentials, even without list permissions. This allows unauthorized access to sensitive vault-stored credentials without requiring admin or owner privileges, provided the attacker knows or can guess the target secret name. Public exploit code exists for this vulnerability.
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute arbitrary SQL queries against PostgreSQL backends, enabling data modification and deletion. Public exploit code exists for this vulnerability. Affected versions prior to 1.123.26, 2.13.3, and 2.14.1 should be upgraded immediately, or workflow creation/editing permissions should be restricted to trusted users only.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP email attribute to match a target account's email address, gaining full access that persists even after reverting the email change. This authentication bypass (CWE-287) affects n8n versions prior to 2.4.0 and 1.121.0 where LDAP is configured, and public exploit code exists. The vulnerability requires LDAP to be actively enabled and the attacker to control their own LDAP email attribute, creating a critical account takeover risk for administrators.
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated users with member-level privileges to steal plaintext credentials from other users. The flaw chains name-based credential resolution that doesn't enforce ownership with a permissions bypass affecting generic HTTP credential types (httpBasicAuth, httpHeaderAuth, httpQueryAuth). Attackers can decrypt and exfiltrate credentials without authorization, though native integration credentials remain unaffected.
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit the Merge node's 'Combine by SQL' mode to read arbitrary local files on the n8n host and achieve remote code execution. n8n versions prior to 2.14.1, 2.13.3, and 1.123.26 are affected. The vulnerability carries a CVSS 4.0 score of 9.4 (Critical) due to insufficient sandbox restrictions in the AlaSQL component, allowing SQL injection-style attacks against the host system. No public proof-of-concept or active exploitation (KEV) status has been reported at this time.
Workflow names and execution statistics from arbitrary projects are exposed in n8n versions before 2.36.2 due to missing per-project authorization in the Insights API. Any authenticated user holding an insights-scoped credential can supply arbitrary `projectId` parameters to Insights API routes and retrieve analytics data from projects they have no membership in - a classic IDOR (Insecure Direct Object Reference) pattern. No public exploit code has been identified and the CVSS 4.0 score of 5.3 reflects the limited disclosure scope (execution metadata only, no credential or workflow-payload exposure).
Server-side request forgery in n8n before 2.34.1 allows authenticated low-privileged users to bypass SSRF protection in Code and Function nodes by simultaneously supplying a safe uri parameter and a malicious url parameter to the legacy request helper function. Because the SSRF validation inspects only uri while the HTTP client dispatches using url when both are present, the safety check is rendered ineffective and internal network addresses become reachable. No public exploit or active exploitation has been identified at time of analysis, but the bypass technique is straightforward for any user with Code or Function node authoring rights.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
SSRF protection bypass in n8n's SearXNG Agent tool allows authenticated users to reach internal network hosts that the platform's own security controls are supposed to block. Affected versions are n8n before 2.34.1 and 2.33.x before 2.33.4 when deployed with N8N_SSRF_PROTECTION_ENABLED=true. An attacker with permission to create SearXNG credentials and configure a personal agent can point the API URL at internal infrastructure - cloud metadata endpoints, internal APIs, or intranet services - and receive responses directly through the agent chat interface. No public exploit or active exploitation (CISA KEV) identified at time of analysis.
Sandbox escape in n8n's JavaScript Code node allows authenticated workflow authors to break out of the Node.js VM sandbox by polluting an unfrozen Function.prototype, ultimately recovering a reference to the host process's globalThis object. Affected are n8n deployments running versions prior to 1.123.69, 2.33.4, and 2.34.1 where users hold workflow creation and execution permissions. Full exploitation also requires that specific Node.js modules are present on the allowlist of the deployment's import configuration, raising practical complexity but making impact highly deployment-dependent. No public exploit code or CISA KEV listing has been identified at time of analysis.
ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's GraphQL node allows authenticated workflow authors to bypass per-credential allowed-domains enforcement. When the node's Authentication parameter is set to expression mode and two credentials of different types are attached, the platform enforces the domain restriction of only the first credential while silently forwarding secret material from the second to any destination - including attacker-controlled endpoints. No public exploit has been identified at time of analysis, but the CVSS 4.0 subsequent-system confidentiality impact is rated High, reflecting the downstream value of an exfiltrated credential that may carry permissions well beyond the n8n instance.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
Cross-project credential reference injection in n8n before 2.34.1 allows low-privileged attackers holding a valid MCP Bearer API key to bypass authorization controls in the create_workflow_from_code MCP tool and embed references to credentials belonging to other projects into workflows they should not control. The bypass is conditional on the credential authentication type being set to 'expression', at which point n8n fails to enforce project-scoped authorization on credential objects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 5.3 reflects a realistic, low-complexity network attack by authenticated users.
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.
SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.
Path traversal in n8n's @n8n/computer-use search_files tool exposes arbitrary local files to any actor who can control the tool's search input. Affected versions span all n8n releases before 2.31.5 and the entire 2.32.x branch before 2.32.1, limited to deployments that run AI agent workflows leveraging the computer-use package. An authenticated low-privileged user can bypass the configured base-directory sandbox and retrieve the names and contents of any file readable by the n8n daemon's OS user account. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Prototype pollution in n8n's VM expression engine enables authenticated workflow editors to escape the sandbox and crash the main n8n process by obtaining a reference to a host built-in and corrupting its prototype. Affected versions span the entire 1.x branch prior to 1.123.67 and two 2.x patch lines (before 2.31.5 and 2.32.1), covering both self-hosted deployments and n8n cloud instances using the VM expression engine. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the sandbox escape primitive is technically significant and poses meaningful risk in multi-tenant or loosely-governed deployments.
SSRF protection bypass in n8n's MCP Client node allows any authenticated user with workflow creation or editing rights to reach internal or blocked hosts and read responses back through the workflow. The MCP Client node neither routes outbound requests through n8n's SSRF protection layer nor pins the resolved IP address after DNS resolution, undermining the platform's intended network isolation guarantees. Vendor-released patches exist in versions 2.31.5 and 2.32.1; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Cross-user module cache poisoning in n8n's JavaScript task runner allows an authenticated Code-node user to inject malicious logic into a shared module cache, silently altering other users' workflow executions on the same instance and compromising their data confidentiality, workflow integrity, or execution availability. Affects all multi-user n8n deployments on versions before 1.123.67 (1.x), 2.31.5 (2.31.x), and 2.32.1 (2.32.x) where the JS task runner is active and built-in or external module access is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; despite the 'RCE' tag applied by the reporting source, the vendor advisory explicitly confirms this is a cross-user isolation break and not a sandbox escape or remote code execution.
SQL injection in n8n's Snowflake node Execute Query operation exposes downstream Snowflake databases to unauthorized data access and manipulation when workflow authors embed externally-controlled expression data directly into raw SQL strings without parameterization. Affected across three version lines - n8n below 1.123.67, 2.0.0-rc.0 through below 2.31.5, and 2.32.0 through below 2.32.1 - the flaw is rooted in direct string interpolation rather than prepared statements. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector signals high subsequent-system confidentiality and integrity impact against connected Snowflake environments.
Credential exposure in n8n workflow automation platform leaks full Google Service Account PEM private keys into the JWT header's kid field, where they are trivially recoverable via Base64 decoding. Affected versions span both the 1.x line (before 1.123.64) and the 2.x line (before 2.29.8 and 2.30.1), but only deployments configured with Google Service Account credentials are at risk. An attacker who captures these JWTs from logs, network traffic, or monitoring systems can extract the raw private key and fully impersonate the service account against any Google Cloud resource it is authorized to access. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is recorded in CISA KEV.
Credential exfiltration in n8n's GraphQL node allows authenticated non-owner users to bypass the platform's 'Allowed HTTP Request Domains' domain-restriction policy and route HTTP-based credentials to an attacker-controlled server. Unlike the HTTP Request node, which correctly enforces domain allowlists, the GraphQL node omits this authorization check entirely, meaning any low-privileged workflow editor can redirect HTTP-based credential types - Header Auth, Basic Auth, Query Auth, and OAuth - to an arbitrary endpoint. No public exploit code or active exploitation has been identified at time of analysis; impact is bounded to deployments using domain-restricted shared credentials.
Broken authorization in n8n's OAuth 2.1 consent flow allows a member-level authenticated user to self-approve OAuth consent for workflows they do not own, then execute those workflows in the victim owner's project context using the owner's stored credentials. Versions 2.27.0 through 2.29.7 and 2.30.0 are affected - the flaw was introduced precisely when the OAuth 2.1 MCP Server Trigger flow was added. On multi-user instances with at least one OAuth2-enabled MCP Server Trigger workflow, the attacker obtains a valid token, drives the workflow with attacker-controlled inputs, and reads outputs that may include sensitive data exfiltrated from the owner's connected third-party integrations, breaking both user and project isolation. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Server-side request forgery in n8n workflow automation platform (versions before 1.123.64) enables authenticated low-privilege users to redirect the n8n server's HTTP requests to arbitrary internal network targets by injecting absolute URLs into routing configuration on dynamic-node-parameters endpoints that lack authorization scopes. The CVSS 4.0 vector assigns SC:H - high subsequent-system confidentiality impact - reflecting the risk of internal infrastructure exposure including cloud metadata endpoints, internal APIs, and private services. Exploitation is conditional on SSRF protection being disabled; no public exploit identified at time of analysis and no CISA KEV listing.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Credential exposure in n8n's LLM sub-node allows authenticated users to read plaintext API keys and secrets persisted in workflow execution records. Versions before 1.123.64 fail to mask custom HTTP header values - such as Authorization or X-API-Key headers - when those headers are used in LLM node configurations, causing secrets to be written in cleartext to execution data stored in the database. While exploitation requires a low-privilege authenticated session, the downstream impact is high because recovered credentials can be used to access external APIs and services configured in those workflows. No public exploit code or KEV listing has been identified at time of analysis.
Unauthenticated cancellation of active test webhook sessions is possible in n8n prior to 2.28.0 (and prior to 2.27.4 on the 2.27.x branch) because the DELETE test-webhook endpoint is registered before the authentication middleware stack, making it reachable by any network caller who possesses a valid workflow ID. The impact is deliberately scoped: only in-progress developer test sessions can be disrupted; production webhooks, persistent workflow state, and stored data are explicitly unaffected per the vendor advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 AT:P qualifier confirms a workflow-ID prerequisite limits opportunistic mass exploitation.
n8n contains an LDAP injection vulnerability in the LDAP node's filter escape logic that allows LDAP metacharacters to pass through unescaped when user-controlled input is interpolated into LDAP search filters. This affects n8n versions prior to 1.123.27, 2.13.3, and 2.14.1, enabling attackers to manipulate LDAP queries to retrieve unintended directory records or bypass authentication controls implemented within workflows. The vulnerability requires specific workflow configuration (LDAP node receiving external user input via expressions) and has not been publicly reported as actively exploited, though no proof-of-concept availability is explicitly confirmed across available intelligence sources.
A stored cross-site scripting (XSS) vulnerability in n8n workflow automation platform allows authenticated users to craft malicious workflows that execute arbitrary JavaScript in the browsers of higher-privileged users. Affected versions are n8n prior to 1.123.27, 2.13.3, and 2.14.1 (identified via CPE cpe:2.3:a:n8n-io:n8n). An attacker with workflow creation/modification permissions can exploit the `/rest/binary-data` endpoint's failure to properly sanitize HTML responses, enabling credential theft, workflow manipulation, and privilege escalation to administrative access with full same-origin context.
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allows network-positioned attackers to perform man-in-the-middle attacks against Git operations. Affected users who have explicitly enabled and configured SSH-based source control can have their workflows injected with malicious content or have repository data intercepted without authentication. While the feature is non-default and requires explicit configuration, the vulnerability enables complete compromise of workflow integrity and potential lateral movement within automation pipelines.
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callback handler that occurs when the N8N_SKIP_AUTH_ON_OAUTH_CALLBACK environment variable is explicitly set to true. An attacker can manipulate the OAuth state parameter verification to trick a victim into completing an OAuth flow that stores the victim's OAuth tokens in an attacker-controlled credential object, allowing the attacker to execute workflows using the victim's delegated permissions. The vulnerability affects n8n versions prior to 2.8.0 and requires non-default configuration to be exploitable, limiting its widespread impact but creating significant risk for affected deployments.
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. This bypasses n8n's credential API blank-value redaction, effectively leaking third-party service credentials to any n8n user who can inspect execution results. No public exploit or CISA KEV listing exists at time of analysis; patches are available in versions 1.123.73, 2.35.4, and 2.36.2.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's workflow execution engine allows a low-privileged authenticated user to reference another user's credentials inside an inline sub-workflow node (such as the Workflow Tool node) without any ownership validation. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. When a privileged execution context later runs the poisoned workflow and resolves the referenced secret, the sub-workflow can forward the plaintext credential to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the VulnCheck advisory corroborates the GitHub Security Advisory GHSA-4r56-g65c-fm83.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.
Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Decrypted credential secrets are exposed in execution logs in n8n workflow automation software across versions before 1.123.69, 2.33.4, and 2.34.1. The GraphQL node fails to wrap connection-level HTTP client errors in n8n's standard error type, propagating raw error objects - which carry decrypted credential headers - directly into the persistent execution record. Any authenticated user with read access to workflow execution history can recover those plaintext secrets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and direct credential exposure make this a high-priority remediation target for shared or multi-tenant deployments.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. No public exploit identified at time of analysis, but the CVSS 4.0 subsequent-system impact is rated high across confidentiality, integrity, and availability, reflecting the catastrophic downstream database risk.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Credential exfiltration in n8n's AI and LLM workflow nodes allows low-privileged users with use-only access to shared credentials to bypass the 'Allowed HTTP Request Domains' allowlist and redirect credential secrets to attacker-controlled infrastructure. Affected are all n8n npm installations before version 2.31.5 and the 2.32.0 release (fixed in 2.32.1), where at least one credential has domain restrictions configured and is shared with non-owner users. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the attack is low-complexity for any insider or compromised low-privilege account.
Path traversal in n8n's Git node before versions 1.123.67, 2.31.5, and 2.32.1 allows authenticated low-privilege users to escape the repository sandbox during fetch, pull, and push-tags operations. By pointing an allowlisted remote configuration value at a local filesystem path outside the intended sandbox, an attacker with workflow create/execute rights can pull arbitrary local git repositories into the workspace and read their files and full commit history, including any secrets or credentials stored in git history. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and low-privilege attack path make it a realistic insider or compromised-account threat in multi-user n8n deployments.
Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Credential exfiltration in n8n's workflow automation platform allows any user with Editor access to a shared workflow to bypass authorization checks and use or exfiltrate credentials they are not permitted to access. The flaw exists because n8n validates credential permissions only for a node's top-level credential references, not for credentials embedded inside an Execute Sub-workflow node's inline workflow JSON (Source = Parameter); the embedded reference passes both save-time and runtime validation and resolves using the parent workflow's project context. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects a credible, low-complexity path to high-confidentiality impact when workflow sharing is in use.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Credential disclosure in n8n workflow automation (versions prior to 1.123.61, 2.27.4, and 2.28.1) allows an authenticated member holding use-only editor access to a shared workflow to read credential-populated HTTP headers via the $request object inside an HTTP Request node's pagination expression, then exfiltrate the secret through returned item data. This defeats n8n's credential-hiding model, which is supposed to prevent low-privilege collaborators from seeing the underlying secret values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the EPSS/POC signals were not provided.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
Authentication bypass in n8n's external identity resolution lets an attacker impersonate other users when the instance trusts more than one token-exchange issuer. Affecting n8n before 2.27.4 and version 2.28.0, the flaw stems from resolving federated identities using only the JWT sub claim while ignoring the iss claim, so a valid token from one trusted issuer whose sub matches a victim registered under a different issuer grants full access to that victim's account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authentication-level impact (VC:H/VI:H) makes it a meaningful account-takeover risk for multi-issuer SSO deployments.
Credential secret exfiltration in n8n (self-hosted workflow automation) prior to 2.27.4 and 2.28.1 lets a low-privilege member with use-only access to a shared credential leak that secret to an attacker-controlled server. The AI Agents feature fails to enforce the 'Allowed HTTP Request Domains' restriction when an MCP tool is aimed at an arbitrary URL, so the guardrail meant to keep secrets in-bounds is bypassed. No public exploit identified at time of analysis; risk is elevated because the abuse comes from an already-authorized internal user rather than an outside attacker.
Authenticated users in n8n versions prior to 1.123.23 and 2.6.4 can bypass external secrets permission checks to retrieve plaintext secret values from configured vaults by referencing secrets by name in credentials, even without list permissions. This allows unauthorized access to sensitive vault-stored credentials without requiring admin or owner privileges, provided the attacker knows or can guess the target secret name. Public exploit code exists for this vulnerability.
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute arbitrary SQL queries against PostgreSQL backends, enabling data modification and deletion. Public exploit code exists for this vulnerability. Affected versions prior to 1.123.26, 2.13.3, and 2.14.1 should be upgraded immediately, or workflow creation/editing permissions should be restricted to trusted users only.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP email attribute to match a target account's email address, gaining full access that persists even after reverting the email change. This authentication bypass (CWE-287) affects n8n versions prior to 2.4.0 and 1.121.0 where LDAP is configured, and public exploit code exists. The vulnerability requires LDAP to be actively enabled and the attacker to control their own LDAP email attribute, creating a critical account takeover risk for administrators.
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated users with member-level privileges to steal plaintext credentials from other users. The flaw chains name-based credential resolution that doesn't enforce ownership with a permissions bypass affecting generic HTTP credential types (httpBasicAuth, httpHeaderAuth, httpQueryAuth). Attackers can decrypt and exfiltrate credentials without authorization, though native integration credentials remain unaffected.
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit the Merge node's 'Combine by SQL' mode to read arbitrary local files on the n8n host and achieve remote code execution. n8n versions prior to 2.14.1, 2.13.3, and 1.123.26 are affected. The vulnerability carries a CVSS 4.0 score of 9.4 (Critical) due to insufficient sandbox restrictions in the AlaSQL component, allowing SQL injection-style attacks against the host system. No public proof-of-concept or active exploitation (KEV) status has been reported at this time.
Workflow names and execution statistics from arbitrary projects are exposed in n8n versions before 2.36.2 due to missing per-project authorization in the Insights API. Any authenticated user holding an insights-scoped credential can supply arbitrary `projectId` parameters to Insights API routes and retrieve analytics data from projects they have no membership in - a classic IDOR (Insecure Direct Object Reference) pattern. No public exploit code has been identified and the CVSS 4.0 score of 5.3 reflects the limited disclosure scope (execution metadata only, no credential or workflow-payload exposure).
Server-side request forgery in n8n before 2.34.1 allows authenticated low-privileged users to bypass SSRF protection in Code and Function nodes by simultaneously supplying a safe uri parameter and a malicious url parameter to the legacy request helper function. Because the SSRF validation inspects only uri while the HTTP client dispatches using url when both are present, the safety check is rendered ineffective and internal network addresses become reachable. No public exploit or active exploitation has been identified at time of analysis, but the bypass technique is straightforward for any user with Code or Function node authoring rights.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
SSRF protection bypass in n8n's SearXNG Agent tool allows authenticated users to reach internal network hosts that the platform's own security controls are supposed to block. Affected versions are n8n before 2.34.1 and 2.33.x before 2.33.4 when deployed with N8N_SSRF_PROTECTION_ENABLED=true. An attacker with permission to create SearXNG credentials and configure a personal agent can point the API URL at internal infrastructure - cloud metadata endpoints, internal APIs, or intranet services - and receive responses directly through the agent chat interface. No public exploit or active exploitation (CISA KEV) identified at time of analysis.
Sandbox escape in n8n's JavaScript Code node allows authenticated workflow authors to break out of the Node.js VM sandbox by polluting an unfrozen Function.prototype, ultimately recovering a reference to the host process's globalThis object. Affected are n8n deployments running versions prior to 1.123.69, 2.33.4, and 2.34.1 where users hold workflow creation and execution permissions. Full exploitation also requires that specific Node.js modules are present on the allowlist of the deployment's import configuration, raising practical complexity but making impact highly deployment-dependent. No public exploit code or CISA KEV listing has been identified at time of analysis.
ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's GraphQL node allows authenticated workflow authors to bypass per-credential allowed-domains enforcement. When the node's Authentication parameter is set to expression mode and two credentials of different types are attached, the platform enforces the domain restriction of only the first credential while silently forwarding secret material from the second to any destination - including attacker-controlled endpoints. No public exploit has been identified at time of analysis, but the CVSS 4.0 subsequent-system confidentiality impact is rated High, reflecting the downstream value of an exfiltrated credential that may carry permissions well beyond the n8n instance.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
Cross-project credential reference injection in n8n before 2.34.1 allows low-privileged attackers holding a valid MCP Bearer API key to bypass authorization controls in the create_workflow_from_code MCP tool and embed references to credentials belonging to other projects into workflows they should not control. The bypass is conditional on the credential authentication type being set to 'expression', at which point n8n fails to enforce project-scoped authorization on credential objects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 5.3 reflects a realistic, low-complexity network attack by authenticated users.
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.
SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.
Path traversal in n8n's @n8n/computer-use search_files tool exposes arbitrary local files to any actor who can control the tool's search input. Affected versions span all n8n releases before 2.31.5 and the entire 2.32.x branch before 2.32.1, limited to deployments that run AI agent workflows leveraging the computer-use package. An authenticated low-privileged user can bypass the configured base-directory sandbox and retrieve the names and contents of any file readable by the n8n daemon's OS user account. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Prototype pollution in n8n's VM expression engine enables authenticated workflow editors to escape the sandbox and crash the main n8n process by obtaining a reference to a host built-in and corrupting its prototype. Affected versions span the entire 1.x branch prior to 1.123.67 and two 2.x patch lines (before 2.31.5 and 2.32.1), covering both self-hosted deployments and n8n cloud instances using the VM expression engine. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the sandbox escape primitive is technically significant and poses meaningful risk in multi-tenant or loosely-governed deployments.
SSRF protection bypass in n8n's MCP Client node allows any authenticated user with workflow creation or editing rights to reach internal or blocked hosts and read responses back through the workflow. The MCP Client node neither routes outbound requests through n8n's SSRF protection layer nor pins the resolved IP address after DNS resolution, undermining the platform's intended network isolation guarantees. Vendor-released patches exist in versions 2.31.5 and 2.32.1; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Cross-user module cache poisoning in n8n's JavaScript task runner allows an authenticated Code-node user to inject malicious logic into a shared module cache, silently altering other users' workflow executions on the same instance and compromising their data confidentiality, workflow integrity, or execution availability. Affects all multi-user n8n deployments on versions before 1.123.67 (1.x), 2.31.5 (2.31.x), and 2.32.1 (2.32.x) where the JS task runner is active and built-in or external module access is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; despite the 'RCE' tag applied by the reporting source, the vendor advisory explicitly confirms this is a cross-user isolation break and not a sandbox escape or remote code execution.
SQL injection in n8n's Snowflake node Execute Query operation exposes downstream Snowflake databases to unauthorized data access and manipulation when workflow authors embed externally-controlled expression data directly into raw SQL strings without parameterization. Affected across three version lines - n8n below 1.123.67, 2.0.0-rc.0 through below 2.31.5, and 2.32.0 through below 2.32.1 - the flaw is rooted in direct string interpolation rather than prepared statements. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector signals high subsequent-system confidentiality and integrity impact against connected Snowflake environments.
Credential exposure in n8n workflow automation platform leaks full Google Service Account PEM private keys into the JWT header's kid field, where they are trivially recoverable via Base64 decoding. Affected versions span both the 1.x line (before 1.123.64) and the 2.x line (before 2.29.8 and 2.30.1), but only deployments configured with Google Service Account credentials are at risk. An attacker who captures these JWTs from logs, network traffic, or monitoring systems can extract the raw private key and fully impersonate the service account against any Google Cloud resource it is authorized to access. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is recorded in CISA KEV.
Credential exfiltration in n8n's GraphQL node allows authenticated non-owner users to bypass the platform's 'Allowed HTTP Request Domains' domain-restriction policy and route HTTP-based credentials to an attacker-controlled server. Unlike the HTTP Request node, which correctly enforces domain allowlists, the GraphQL node omits this authorization check entirely, meaning any low-privileged workflow editor can redirect HTTP-based credential types - Header Auth, Basic Auth, Query Auth, and OAuth - to an arbitrary endpoint. No public exploit code or active exploitation has been identified at time of analysis; impact is bounded to deployments using domain-restricted shared credentials.
Broken authorization in n8n's OAuth 2.1 consent flow allows a member-level authenticated user to self-approve OAuth consent for workflows they do not own, then execute those workflows in the victim owner's project context using the owner's stored credentials. Versions 2.27.0 through 2.29.7 and 2.30.0 are affected - the flaw was introduced precisely when the OAuth 2.1 MCP Server Trigger flow was added. On multi-user instances with at least one OAuth2-enabled MCP Server Trigger workflow, the attacker obtains a valid token, drives the workflow with attacker-controlled inputs, and reads outputs that may include sensitive data exfiltrated from the owner's connected third-party integrations, breaking both user and project isolation. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Server-side request forgery in n8n workflow automation platform (versions before 1.123.64) enables authenticated low-privilege users to redirect the n8n server's HTTP requests to arbitrary internal network targets by injecting absolute URLs into routing configuration on dynamic-node-parameters endpoints that lack authorization scopes. The CVSS 4.0 vector assigns SC:H - high subsequent-system confidentiality impact - reflecting the risk of internal infrastructure exposure including cloud metadata endpoints, internal APIs, and private services. Exploitation is conditional on SSRF protection being disabled; no public exploit identified at time of analysis and no CISA KEV listing.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Credential exposure in n8n's LLM sub-node allows authenticated users to read plaintext API keys and secrets persisted in workflow execution records. Versions before 1.123.64 fail to mask custom HTTP header values - such as Authorization or X-API-Key headers - when those headers are used in LLM node configurations, causing secrets to be written in cleartext to execution data stored in the database. While exploitation requires a low-privilege authenticated session, the downstream impact is high because recovered credentials can be used to access external APIs and services configured in those workflows. No public exploit code or KEV listing has been identified at time of analysis.
Unauthenticated cancellation of active test webhook sessions is possible in n8n prior to 2.28.0 (and prior to 2.27.4 on the 2.27.x branch) because the DELETE test-webhook endpoint is registered before the authentication middleware stack, making it reachable by any network caller who possesses a valid workflow ID. The impact is deliberately scoped: only in-progress developer test sessions can be disrupted; production webhooks, persistent workflow state, and stored data are explicitly unaffected per the vendor advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 AT:P qualifier confirms a workflow-ID prerequisite limits opportunistic mass exploitation.
n8n contains an LDAP injection vulnerability in the LDAP node's filter escape logic that allows LDAP metacharacters to pass through unescaped when user-controlled input is interpolated into LDAP search filters. This affects n8n versions prior to 1.123.27, 2.13.3, and 2.14.1, enabling attackers to manipulate LDAP queries to retrieve unintended directory records or bypass authentication controls implemented within workflows. The vulnerability requires specific workflow configuration (LDAP node receiving external user input via expressions) and has not been publicly reported as actively exploited, though no proof-of-concept availability is explicitly confirmed across available intelligence sources.
A stored cross-site scripting (XSS) vulnerability in n8n workflow automation platform allows authenticated users to craft malicious workflows that execute arbitrary JavaScript in the browsers of higher-privileged users. Affected versions are n8n prior to 1.123.27, 2.13.3, and 2.14.1 (identified via CPE cpe:2.3:a:n8n-io:n8n). An attacker with workflow creation/modification permissions can exploit the `/rest/binary-data` endpoint's failure to properly sanitize HTML responses, enabling credential theft, workflow manipulation, and privilege escalation to administrative access with full same-origin context.
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allows network-positioned attackers to perform man-in-the-middle attacks against Git operations. Affected users who have explicitly enabled and configured SSH-based source control can have their workflows injected with malicious content or have repository data intercepted without authentication. While the feature is non-default and requires explicit configuration, the vulnerability enables complete compromise of workflow integrity and potential lateral movement within automation pipelines.
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callback handler that occurs when the N8N_SKIP_AUTH_ON_OAUTH_CALLBACK environment variable is explicitly set to true. An attacker can manipulate the OAuth state parameter verification to trick a victim into completing an OAuth flow that stores the victim's OAuth tokens in an attacker-controlled credential object, allowing the attacker to execute workflows using the victim's delegated permissions. The vulnerability affects n8n versions prior to 2.8.0 and requires non-default configuration to be exploitable, limiting its widespread impact but creating significant risk for affected deployments.