Vulnerabilidades de N8n-io

CVE-2026-110853 Alta · 7.1 CWE-639 14/10/2026

n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.

CVE-2026-110852 Média · 6.3 CWE-288 14/10/2026

n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

CVE-2026-110851 Média · 6.1 CWE-639 14/10/2026

n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.

CVE-2026-110850 Alta · 7.2 CWE-863 14/10/2026

n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.

CVE-2026-110849 Alta · 7.2 CWE-79 14/10/2026

n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.

CVE-2026-110848 Média · 6.0 CWE-1321 14/10/2026

n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.

CVE-2026-110847 Alta · 7.0 CWE-79 14/10/2026

n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.

CVE-2026-110846 Alta · 7.0 CWE-180 14/10/2026

n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.

CVE-2026-110845 Alta · 7.7 CWE-15 14/10/2026

n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.

CVE-2026-110844 Alta · 7.2 CWE-863 14/10/2026

n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows

n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.

CVE-2026-110843 Alta · 8.2 CWE-770 14/10/2026

n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.

CVE-2026-110842 Alta · 7.7 CWE-1321 14/10/2026

n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.

CVE-2026-110841 Média · 6.1 CWE-639 14/10/2026

n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval

n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.

CVE-2026-110840 Alta · 7.0 CWE-89 14/10/2026

n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.

CVE-2026-54308 Alta · 7.2 CWE-290 23/06/2026

n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.

CVE-2026-54307 Crítica · 9.6 CWE-863 23/06/2026

n8n: Autorização Incorreta Permite Acesso Cruzado a Credenciais de Outros Usuários via Editores de Workflows Compartilhados

n8n é uma plataforma de automação de workflows de código aberto. Antes das versões 1.123.55, 2.25.7 e 2.26.2, um usuário de nível membro com acesso de editor a um workflow compartilhado poderia referenciar credenciais que não possui por meio de endpoints específicos da API pública. As verificações de propriedade de credenciais eram aplicadas apenas parcialmente, levando a acesso cruzado a credenciais entre usuários. Este problema afeta instâncias em que o compartilhamento de workflows está habilitado e pelo menos um workflow foi compartilhado com um usuário de nível membro como Editor. Esta vulnerabilidade está corrigida nas versões 1.123.55, 2.25.7 e 2.26.2.

CVE-2026-54306 Média · 6.4 CWE-1321 23/06/2026

n8n: Prototype Pollution enables confused-deputy execution via public webhooks

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.

CVE-2026-54305 Crítica · 9.9 CWE-200 23/06/2026

n8n: ausência de verificação de autorização nos endpoints do Dynamic Credentials

n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes das versões 1.123.55, 2.25.7 e 2.26.2, três endpoints EE usados pelo recurso Dynamic Credentials aceitavam qualquer sessão autenticada no n8n sem realizar verificações de propriedade ou de escopo por recurso sobre o fluxo de trabalho ou a credencial de destino. Um usuário autenticado sem vínculo de projeto ou relação de compartilhamento de credencial poderia enumerar identificadores, nomes e tipos de credenciais referenciadas por qualquer fluxo de trabalho privado da instância, iniciar um fluxo de autorização OAuth sobre a credencial de outro usuário para sobrescrever seus tokens armazenados com tokens vinculados a uma conta sob controle do atacante, ou revogar integralmente os tokens armazenados de outro usuário. Fluxos de trabalho que dependam de uma credencial sequestrada passariam a executar sob a identidade OAuth do atacante, possibilitando a exfiltração de dados para serviços externos controlados pelo atacante e a tomada persistente de integrações. A revogação de tokens quebraria os fluxos de trabalho afetados. Esta vulnerabilidade está corrigida nas versões 1.123.55, 2.25.7 e 2.26.2.

CVE-2026-54304 Alta · 7.7 CWE-200 23/06/2026

n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.

CVE-2026-54302 Média · 5.4 CWE-79 23/06/2026

n8n: Stored XSS in Chat Trigger Node

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When a logged-in user visited the chat URL, the injected code executed in the n8n origin with that user's session privileges. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

CVE-2026-54301 Média · 5.4 CWE-79 23/06/2026

n8n: Same-Origin XSS in Respond to Webhook Node

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user's session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

CVE-2026-49465 Alta · 7.7 CWE-22 23/06/2026

n8n: Git Node Clone and Push Operations Bypass File Sandbox

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8N_RESTRICT_FILE_ACCESS_TO file sandbox. This allowed the contents of any local git repository accessible to the n8n process to be cloned into an allowed path and read, circumventing the access restrictions that correctly blocked direct file reads to the same paths. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.

CVE-2026-49444 Alta · 8.5 CWE-20 23/06/2026

n8n: Python sandbox escape

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.

CVE-2026-45732 Alta · 8.1 CWE-639 23/06/2026

n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow and overwrite the stored token material for that credential with tokens bound to an external account they control. Workflows relying on the affected credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of shared integrations. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

CVE-2026-44792 Crítica · 9.0 CWE-89 23/06/2026

Injeção de SQL no n8n via importação de Data Table pelo Source Control (CVE-2026-44792)

n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes das versões 1.123.43, 2.22.1 e 2.20.7, um invasor com permissão de escrita no repositório git conectado a uma configuração de Source Control do n8n poderia fazer commit de um arquivo JSON de Data Table malicioso contendo um nome de coluna elaborado. Quando um administrador executava um Source Control Pull, o n8n importava o arquivo e isso podia levar a injeção de SQL na instância interna do PostgreSQL. A exploração exige que a instância do n8n use PostgreSQL como banco de dados, que o recurso Source Control esteja habilitado e conectado a um repositório no qual o invasor possa escrever, e que um administrador acione um Source Control Pull. Esta vulnerabilidade está corrigida nas versões 1.123.43, 2.22.1 e 2.20.7.