CVE Tools
Track your stack

N8N

250 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for N8N, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

N8N CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
N8N CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-041
2025-050
2025-061
2025-072
2025-082
2025-092
2025-102
2025-110
2025-125
2026-016
2026-0224
2026-0315
2026-040
2026-0514
2026-0632
2026-0749
2026-0834
2026-0928
2026-1030

Severity

How the 250 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical3116%
  • High8342%
  • Medium8543%

Latest CVEs

The 15 most recently published vulnerabilities affecting N8N.

  1. CVE-2026-110853n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON—
  2. CVE-2026-110852n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution—
  3. CVE-2026-110851n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint—
  4. CVE-2026-110850n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters—
  5. CVE-2026-110849n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview—
  6. CVE-2026-110848n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge—
  7. CVE-2026-110847n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter—
  8. CVE-2026-110846n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook—
  9. CVE-2026-110845n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation—
  10. CVE-2026-110844n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows—
  11. CVE-2026-110843n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint—
  12. CVE-2026-110842n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter—
  13. CVE-2026-110841n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval—
  14. CVE-2026-110840n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field—
  15. CVE-2026-103260n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node4.0

Product grouping is registry-driven, with AI assist and human review. How it works