Vulnerabilidades de N8n

CVE-2026-56352 Média · 6.4 CWE-22 15/07/2026

n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter

n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8N_RESTRICT_FILE_ACCESS_TO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.

CVE-2026-56349 Média · 6.3 CWE-20 15/07/2026

n8n - Guardrail Node Bypass via Crafted Input

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

CVE-2026-58661 Média · 4.3 CWE-770 10/07/2026

n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

CVE-2026-56354 Média · 5.4 CWE-79 10/07/2026

n8n - Cross-Site Scripting and Open Redirect in Form Node

n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to perform stored XSS attacks or phishing redirects against end users.

CVE-2026-59209 Média · 6.5 CWE-200 09/07/2026

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

CVE-2026-59208 Média · 6.8 CWE-346 09/07/2026

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

CVE-2026-59207 Média · 6.5 CWE-693 09/07/2026

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1.

CVE-2026-59206 Alta · 7.1 CWE-1321 09/07/2026

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

CVE-2026-59257 Alta · 8.8 CWE-89 08/07/2026

n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.

CVE-2026-59253 Média · 5.0 CWE-639 08/07/2026

n8n - Improper Authorization in Workflow Assignment to Folders

n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.

CVE-2026-56778 Média · 6.4 CWE-863 08/07/2026

n8n - Authorization Bypass in Public API Execution Retry Endpoint

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.

CVE-2026-56776 Alta · 7.4 CWE-863 08/07/2026

n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unintended outbound API calls, data mutations, or other side effects in connected downstream systems. The issue primarily affects instances using the Evaluations feature where RBAC project roles grant workflow:read without workflow:execute.

CVE-2026-56775 Média · 5.4 CWE-863 08/07/2026

n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.

CVE-2026-56360 Média · 4.0 CWE-290 08/07/2026

n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

CVE-2026-56359 Média · 5.4 CWE-79 08/07/2026

n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.

CVE-2025-71380 Alta · 8.8 CWE-284 03/07/2026

n8n - Arbitrary Command Execution via Execute Command Node

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

CVE-2026-56777 Média · 5.0 CWE-184 30/06/2026

n8n - AST Validator Bypass in Python Code Node

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.

CVE-2026-56356 Média · 5.4 CWE-79 30/06/2026

n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.

CVE-2026-56350 Alta · 7.7 CWE-285 30/06/2026

n8n - SSO Enforcement Bypass via API

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

CVE-2026-56358 Média · 5.4 CWE-79 24/06/2026

n8n - Stored Cross-Site Scripting in Form Trigger Node

n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.

CVE-2026-56351 Crítica · 9.6 CWE-89 24/06/2026

Injeção de SQL nos nós MySQL, PostgreSQL e Microsoft SQL do n8n

O n8n anterior à versão 2.4.0 contém uma vulnerabilidade de injeção de SQL nos nós MySQL, PostgreSQL e Microsoft SQL, que permite que usuários autenticados injetem SQL arbitrário por meio de valores de identificadores não escapados nos parâmetros de configuração dos nós. Atacantes com permissões de criação de workflows podem fornecer nomes de tabelas ou colunas especialmente elaborados para executar comandos de banco de dados não autorizados e comprometer a integridade dos dados.

CVE-2026-54308 Alta · 7.2 CWE-290 23/06/2026

n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.

CVE-2026-54307 Crítica · 9.6 CWE-863 23/06/2026

n8n: Autorização Incorreta Permite Acesso Cruzado a Credenciais de Outros Usuários via Editores de Workflows Compartilhados

n8n é uma plataforma de automação de workflows de código aberto. Antes das versões 1.123.55, 2.25.7 e 2.26.2, um usuário de nível membro com acesso de editor a um workflow compartilhado poderia referenciar credenciais que não possui por meio de endpoints específicos da API pública. As verificações de propriedade de credenciais eram aplicadas apenas parcialmente, levando a acesso cruzado a credenciais entre usuários. Este problema afeta instâncias em que o compartilhamento de workflows está habilitado e pelo menos um workflow foi compartilhado com um usuário de nível membro como Editor. Esta vulnerabilidade está corrigida nas versões 1.123.55, 2.25.7 e 2.26.2.

CVE-2026-54306 Média · 6.4 CWE-1321 23/06/2026

n8n: Prototype Pollution enables confused-deputy execution via public webhooks

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.

CVE-2026-54305 Crítica · 9.9 CWE-200 23/06/2026

n8n: ausência de verificação de autorização nos endpoints do Dynamic Credentials

n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes das versões 1.123.55, 2.25.7 e 2.26.2, três endpoints EE usados pelo recurso Dynamic Credentials aceitavam qualquer sessão autenticada no n8n sem realizar verificações de propriedade ou de escopo por recurso sobre o fluxo de trabalho ou a credencial de destino. Um usuário autenticado sem vínculo de projeto ou relação de compartilhamento de credencial poderia enumerar identificadores, nomes e tipos de credenciais referenciadas por qualquer fluxo de trabalho privado da instância, iniciar um fluxo de autorização OAuth sobre a credencial de outro usuário para sobrescrever seus tokens armazenados com tokens vinculados a uma conta sob controle do atacante, ou revogar integralmente os tokens armazenados de outro usuário. Fluxos de trabalho que dependam de uma credencial sequestrada passariam a executar sob a identidade OAuth do atacante, possibilitando a exfiltração de dados para serviços externos controlados pelo atacante e a tomada persistente de integrações. A revogação de tokens quebraria os fluxos de trabalho afetados. Esta vulnerabilidade está corrigida nas versões 1.123.55, 2.25.7 e 2.26.2.