N8N Io

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-72772	Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.	HIGH	8.9	0.2%	45
CVE-2026-71539	Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.	HIGH	8.9	0.2%	45
CVE-2026-77068	Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.	HIGH	8.7	0.5%	44
CVE-2026-72767	Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.	HIGH	8.7	0.4%	44
CVE-2026-85169	Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.	HIGH	8.7	0.4%	44
CVE-2026-72765	Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.	HIGH	8.7	0.4%	44
CVE-2026-77080	Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.	HIGH	8.7	0.2%	44
CVE-2026-103259	Session token leakage in n8n's Dynamic Credentials authorize and revoke endpoints lets an attacker who already holds resolver-registration privileges point a fallback resolver at an attacker-controlled endpoint and capture a collaborating user's session token once that user completes the account-connection flow, yielding unauthorized credential access. Impact is access-gated rather than open: exploitation requires an authenticated, high-privileged actor plus an independent user interaction, and is realistic mainly on shared or multi-tenant n8n instances where semi-trusted users hold resolver-registration rights, not against a default single-tenant deployment reachable by an unprivileged remote attacker. Affected versions are n8n before 2.39.6 and 2.40.0 before 2.40.1; vendor-released patches exist, and neither a public proof-of-concept exploit nor confirmed active exploitation (CISA KEV) was identified at time of analysis.	HIGH	8.5	0.2%	42
CVE-2026-77075	Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.	HIGH	8.4	0.3%	42
CVE-2026-77072	Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.	HIGH	8.4	0.2%	42
CVE-2026-103246	n8n automation instances running versions before 2.39.6 or 2.40.0 before 2.40.1 permit an authenticated attacker with low privileges to decrypt and exfiltrate stored plaintext credentials by referencing arbitrary credential IDs during inline AI agent node-tool introspection, which fails to verify credential ownership (CWE-639). Successful exploitation yields high confidentiality impact with a scope change (CVSS 3.1 base 8.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attacker must hold a valid account able to build or edit workflows, know or enumerate internal credential IDs, and operate an attacker-controlled host to receive the secrets. No public exploit identified at time of analysis, and vendor patches are available as 2.39.6 and 2.40.1.	HIGH	8.3	0.3%	42
CVE-2026-72766	Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.	HIGH	8.2	0.3%	41
CVE-2026-103257	Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.	HIGH	8.1	0.4%	40
CVE-2026-85168	Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.	HIGH	7.7	0.4%	39
CVE-2026-77084	Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.	HIGH	7.7	0.3%	39

CVE-2026-72772

Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.

HIGH

8.9

0.2%

45

CVE-2026-71539

Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.

HIGH

8.9

0.2%

45

CVE-2026-77068

Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.

HIGH

8.7

0.5%

44

CVE-2026-72767

Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.

HIGH

8.7

0.4%

44

CVE-2026-85169

Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.

HIGH

8.7

0.4%

44

CVE-2026-72765

Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.

HIGH

8.7

0.4%

44

CVE-2026-77080

Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.

HIGH

8.7

0.2%

44

CVE-2026-103259

Session token leakage in n8n's Dynamic Credentials authorize and revoke endpoints lets an attacker who already holds resolver-registration privileges point a fallback resolver at an attacker-controlled endpoint and capture a collaborating user's session token once that user completes the account-connection flow, yielding unauthorized credential access. Impact is access-gated rather than open: exploitation requires an authenticated, high-privileged actor plus an independent user interaction, and is realistic mainly on shared or multi-tenant n8n instances where semi-trusted users hold resolver-registration rights, not against a default single-tenant deployment reachable by an unprivileged remote attacker. Affected versions are n8n before 2.39.6 and 2.40.0 before 2.40.1; vendor-released patches exist, and neither a public proof-of-concept exploit nor confirmed active exploitation (CISA KEV) was identified at time of analysis.

HIGH

8.5

0.2%

42

CVE-2026-77075

Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.

HIGH

8.4

0.3%

42

CVE-2026-77072

Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.

HIGH

8.4

0.2%

42

CVE-2026-103246

n8n automation instances running versions before 2.39.6 or 2.40.0 before 2.40.1 permit an authenticated attacker with low privileges to decrypt and exfiltrate stored plaintext credentials by referencing arbitrary credential IDs during inline AI agent node-tool introspection, which fails to verify credential ownership (CWE-639). Successful exploitation yields high confidentiality impact with a scope change (CVSS 3.1 base 8.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attacker must hold a valid account able to build or edit workflows, know or enumerate internal credential IDs, and operate an attacker-controlled host to receive the secrets. No public exploit identified at time of analysis, and vendor patches are available as 2.39.6 and 2.40.1.

HIGH

8.3

0.3%

42

CVE-2026-72766

Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.

HIGH

8.2

0.3%

41

CVE-2026-103257

Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.

HIGH

8.1

0.4%

40

CVE-2026-85168

Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.

HIGH

7.7

0.4%

39

CVE-2026-77084

Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.

HIGH

7.7

0.3%

39

Severity Breakdown

Monthly CVE Trend

Affected Products (6)

Top Risky CVEs