CVE Tools
Track your stack

N8N-IO

194 CVEs tracked since 2025. Since Dec 2025, 1 of them reached CISA KEV.

N8N-IO CVEs per month

Dec 2025 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
N8N-IO CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-1251
2026-015 or fewer
2026-02180
2026-03110
2026-046 or fewer
2026-05120
2026-06210
2026-07180
2026-08340
2026-09280
2026-10470
2026-110

Products

The products that kept showing up in N8N-IO's monthly top three, with their CVEs summed over those months.

  1. N8N1949 months

Latest CVEs

The 15 most recently published vulnerabilities affecting N8N-IO.

  1. CVE-2026-119557n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node5.9
  2. CVE-2026-119408n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes8.8
  3. CVE-2026-118679n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger7.5
  4. CVE-2026-118678n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction7.1
  5. CVE-2026-118677n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance5.9
  6. CVE-2026-118676n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass7.1
  7. CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow7.1
  8. CVE-2026-118649n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables8.3
  9. CVE-2026-118648n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy7.3
  10. CVE-2026-118647n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data8.2
  11. CVE-2026-118646n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node6.5
  12. CVE-2026-118645n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter8.7
  13. CVE-2026-118644n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance7.7
  14. CVE-2026-118643n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data8.2
  15. CVE-2026-118641n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes7.5

The record

Peak rank
#32 in Oct 2026
Busiest month shown
Oct 2026, 47 CVEs
Months with a KEV entry
1 since Dec 2025
Monthly snapshots
9 since 2025
N8N-IO's full record, month by month