Vulnerabilidades de N8n-io

CVE-2026-65591 Alta · 8.8 CWE-917 22/07/2026

n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

CVE-2026-65590 Crítica · 9.8 CWE-78 22/07/2026

n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.

CVE-2026-65589 Média · 6.5 CWE-532 22/07/2026

n8n before 1.123.64 Credential Exposure via LLM Node Execution Data

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

CVE-2026-65016 Alta · 8.8 CWE-639 22/07/2026

n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.

CVE-2026-65015 Alta · 8.8 CWE-863 22/07/2026

n8n before 2.30.1 Privilege Escalation via run_node_tool

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

CVE-2026-65014 Média · 5.3 CWE-306 22/07/2026

n8n before 2.28.0 Authentication Bypass via test-webhook

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

CVE-2026-59209 Média · 6.5 CWE-200 09/07/2026

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

CVE-2026-59208 Média · 6.8 CWE-346 09/07/2026

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

CVE-2026-59207 Média · 6.5 CWE-693 09/07/2026

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1.

CVE-2026-59206 Alta · 7.1 CWE-1321 09/07/2026

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

CVE-2026-54308 Alta · 7.2 CWE-290 23/06/2026

n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.

CVE-2026-54307 Crítica · 9.6 CWE-863 23/06/2026

n8n: Autorização Incorreta Permite Acesso Cruzado a Credenciais de Outros Usuários via Editores de Workflows Compartilhados

n8n é uma plataforma de automação de workflows de código aberto. Antes das versões 1.123.55, 2.25.7 e 2.26.2, um usuário de nível membro com acesso de editor a um workflow compartilhado poderia referenciar credenciais que não possui por meio de endpoints específicos da API pública. As verificações de propriedade de credenciais eram aplicadas apenas parcialmente, levando a acesso cruzado a credenciais entre usuários. Este problema afeta instâncias em que o compartilhamento de workflows está habilitado e pelo menos um workflow foi compartilhado com um usuário de nível membro como Editor. Esta vulnerabilidade está corrigida nas versões 1.123.55, 2.25.7 e 2.26.2.

CVE-2026-54306 Média · 6.4 CWE-1321 23/06/2026

n8n: Prototype Pollution enables confused-deputy execution via public webhooks

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.

CVE-2026-54305 Crítica · 9.9 CWE-200 23/06/2026

n8n: ausência de verificação de autorização nos endpoints do Dynamic Credentials

n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes das versões 1.123.55, 2.25.7 e 2.26.2, três endpoints EE usados pelo recurso Dynamic Credentials aceitavam qualquer sessão autenticada no n8n sem realizar verificações de propriedade ou de escopo por recurso sobre o fluxo de trabalho ou a credencial de destino. Um usuário autenticado sem vínculo de projeto ou relação de compartilhamento de credencial poderia enumerar identificadores, nomes e tipos de credenciais referenciadas por qualquer fluxo de trabalho privado da instância, iniciar um fluxo de autorização OAuth sobre a credencial de outro usuário para sobrescrever seus tokens armazenados com tokens vinculados a uma conta sob controle do atacante, ou revogar integralmente os tokens armazenados de outro usuário. Fluxos de trabalho que dependam de uma credencial sequestrada passariam a executar sob a identidade OAuth do atacante, possibilitando a exfiltração de dados para serviços externos controlados pelo atacante e a tomada persistente de integrações. A revogação de tokens quebraria os fluxos de trabalho afetados. Esta vulnerabilidade está corrigida nas versões 1.123.55, 2.25.7 e 2.26.2.

CVE-2026-54304 Alta · 7.7 CWE-200 23/06/2026

n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.

CVE-2026-54302 Média · 5.4 CWE-79 23/06/2026

n8n: Stored XSS in Chat Trigger Node

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When a logged-in user visited the chat URL, the injected code executed in the n8n origin with that user's session privileges. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

CVE-2026-54301 Média · 5.4 CWE-79 23/06/2026

n8n: Same-Origin XSS in Respond to Webhook Node

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user's session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

CVE-2026-49465 Alta · 7.7 CWE-22 23/06/2026

n8n: Git Node Clone and Push Operations Bypass File Sandbox

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8N_RESTRICT_FILE_ACCESS_TO file sandbox. This allowed the contents of any local git repository accessible to the n8n process to be cloned into an allowed path and read, circumventing the access restrictions that correctly blocked direct file reads to the same paths. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.

CVE-2026-49444 Alta · 8.5 CWE-20 23/06/2026

n8n: Python sandbox escape

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.

CVE-2026-45732 Alta · 8.1 CWE-639 23/06/2026

n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow and overwrite the stored token material for that credential with tokens bound to an external account they control. Workflows relying on the affected credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of shared integrations. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

CVE-2026-44792 Crítica · 9.0 CWE-89 23/06/2026

Injeção de SQL no n8n via importação de Data Table pelo Source Control (CVE-2026-44792)

n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes das versões 1.123.43, 2.22.1 e 2.20.7, um invasor com permissão de escrita no repositório git conectado a uma configuração de Source Control do n8n poderia fazer commit de um arquivo JSON de Data Table malicioso contendo um nome de coluna elaborado. Quando um administrador executava um Source Control Pull, o n8n importava o arquivo e isso podia levar a injeção de SQL na instância interna do PostgreSQL. A exploração exige que a instância do n8n use PostgreSQL como banco de dados, que o recurso Source Control esteja habilitado e conectado a um repositório no qual o invasor possa escrever, e que um administrador acione um Source Control Pull. Esta vulnerabilidade está corrigida nas versões 1.123.43, 2.22.1 e 2.20.7.

CVE-2026-44791 Crítica · 9.9 CWE-1321 23/06/2026

n8n: Bypass de Correção no Nó XML com Possível RCE

n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes de 1.123.43, 2.22.1 e 2.20.7, um usuário autenticado com permissão para criar ou modificar fluxos de trabalho poderia contornar a correção do CVE-2026-42232 no nó XML. Quando combinado com outros nós, isso poderia levar a RCE no host do n8n. Esta vulnerabilidade é corrigida em 1.123.43, 2.22.1 e 2.20.7.

CVE-2026-44790 Alta · 8.8 CWE-88 23/06/2026

n8n: Arbitrary File Read via Git Node

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

CVE-2026-44789 Crítica · 9.9 CWE-1321 23/06/2026

n8n: Prototype Pollution no Nó HTTP Request via Parâmetro de Paginação

O n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes de 1.123.43, 2.22.1 e 2.20.7, um usuário autenticado com permissão para criar ou modificar fluxos de trabalho poderia obter prototype pollution global por meio de um parâmetro de paginação não validado no nó HTTP Request. Combinada com outras técnicas, essa vulnerabilidade poderia levar a RCE na instância. Esta vulnerabilidade está corrigida nas versões 1.123.43, 2.22.1 e 2.20.7.

CVE-2026-54314 Alta · 7.5 CWE-409 23/06/2026

n8n: Denial of Service via ZIP decompression in webhook workflow

n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.