N8n

This hub aggregates every CVE we track for N8n, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting N8n.

• CVE-2026-59259n8n - Permission Bypass via Expression Parser Mismatch in External Secrets6.5Jul 15, 2026
• CVE-2026-56353n8n - Authentication Bypass in Chat Trigger Node4.8Jul 15, 2026
• CVE-2026-56352n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter6.4Jul 15, 2026
• CVE-2026-58661n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint4.3Jul 10, 2026
• CVE-2026-56354n8n - Cross-Site Scripting and Open Redirect in Form Node4.1Jul 10, 2026
• CVE-2026-59209n8n: Shared Credential Header Leak via HTTP Request Pagination Expression6.5Jul 9, 2026
• CVE-2026-59206n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration7.1Jul 9, 2026
• CVE-2026-59208n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution6.8Jul 9, 2026
• CVE-2026-59207n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector6.5Jul 9, 2026
• CVE-2026-59257n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation8.8Jul 8, 2026
• CVE-2026-59253n8n - Improper Authorization in Workflow Assignment to Folders5.0Jul 8, 2026
• CVE-2026-56778n8n - Authorization Bypass in Public API Execution Retry Endpoint6.4Jul 8, 2026
• CVE-2026-56775n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints5.4Jul 8, 2026
• CVE-2026-56776n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint7.4Jul 8, 2026
• CVE-2026-56360n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger4.0Jul 8, 2026