Known Vulnerabilities for products from N8n
Listed below are 20 of the newest known vulnerabilities associated with the vendor "N8n".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-59257 json | n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v... | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-59253 json | n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folder... | Not Provided | 2026-07-08 | 2026-07-08 |
| CVE-2026-59209 json | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-... | Not Provided | 2026-07-09 | 2026-07-13 |
| CVE-2026-59208 json | n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured... | Not Provided | 2026-07-09 | 2026-07-09 |
| CVE-2026-59207 json | n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the All... | Not Provided | 2026-07-09 | 2026-07-09 |
| CVE-2026-59206 json | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the de... | Not Provided | 2026-07-09 | 2026-07-09 |
| CVE-2026-58661 json | n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table fi... | Not Provided | 2026-07-10 | 2026-07-13 |
| CVE-2026-56778 json | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which... | Not Provided | 2026-07-08 | 2026-07-08 |
| CVE-2026-56777 json | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Cod... | Not Provided | 2026-06-30 | 2026-07-02 |
| CVE-2026-56776 json | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new en... | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-56775 json | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoin... | Not Provided | 2026-07-08 | 2026-07-08 |
| CVE-2026-56360 json | n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node.... | Not Provided | 2026-07-08 | 2026-07-08 |
| CVE-2026-56359 json | n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users ca... | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-56358 json | n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripti... | Not Provided | 2026-06-24 | 2026-06-26 |
| CVE-2026-56357 json | n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to imple... | Not Provided | 2026-06-22 | 2026-06-24 |
| CVE-2026-56356 json | n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguratio... | Not Provided | 2026-06-30 | 2026-07-02 |
| CVE-2026-56354 json | n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vul... | Not Provided | 2026-07-10 | 2026-07-13 |
| CVE-2026-56351 json | n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows aut... | Not Provided | 2026-06-24 | 2026-06-26 |
| CVE-2026-56350 json | n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement ... | Not Provided | 2026-06-30 | 2026-07-02 |
| CVE-2026-56348 json | n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint... | Not Provided | 2026-06-22 | 2026-06-24 |