n8n vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49444Highn8n: n8n: Python sandbox escapeCVE-2026-56348Mediumn8n: n8n: Credential exfiltration via Allowed HTTP Request Domains BypassGHSA-2VX9-7WPG-88JQMediumn8n: n8n: Legacy ExecuteWorkflow Node Bypassed File Path RestrictionsCVE-2026-45732Highn8n: n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth EndpointsCVE-2026-44792Highn8n: n8n Has a Source Control Pull SQL InjectionCVE-2026-44791Criticaln8n: n8n Has an XML Node Prototype Pollution Patch BypassCVE-2026-44790Criticaln8n: n8n Has an Arbitrary File Read via Git NodeCVE-2026-44789Criticaln8n: n8n: HTTP Request Node Pagination Prototype Pollution to RCECVE-2026-42232Criticaln8n: n8n has XML Node Prototype Pollution that to RCECVE-2026-42231Criticaln8n: n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCECVE-2026-42235Highn8n: n8n Vulnerable to XSS via MCP OAuth clientCVE-2026-42226Highn8n: n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key ReplayCVE-2026-42234Highn8n: n8n has a Python Task Runner Sandbox Escape VulnerabilityCVE-2026-42227Mediumn8n: n8n has Public API Variables IDOR that Allows Cross-Project Secret DisclosureCVE-2026-42236Highn8n: n8n Vulnerable to Unauthenticated Denial of Service via MCP Client RegistrationCVE-2026-42228Mediumn8n: n8n Vulnerable to Hijacking of Unauthenticated Chat Execution CVE-2026-42229Mediumn8n: n8n has SQL Injection in SeaTable NodeCVE-2026-42230Mediumn8n: n8n has Open Redirect in MCP OAuth Consent FlowCVE-2026-42233Mediumn8n: n8n has SQL Injection in Oracle Database Node via Limit FieldCVE-2026-42237Mediumn8n: n8n has SQL Injection in Snowflake and MySQL NodesGHSA-364X-8G5J-X2PRMediumn8n: n8n has XSS in its Credential Management FlowGHSA-3C7F-5HGJ-H279Mediumn8n: n8n has XSS in Chat Trigger Node through Custom CSSGHSA-W673-8FJW-457CMediumn8n: n8n: Authenticated XSS and Open Redirect via Form NodeCVE-2026-56358Mediumn8n: n8n has a Stored XSS Vulnerability in its Form TriggerCVE-2026-33751Mediumn8n: n8n Vulnerable to LDAP Filter Injection in LDAP Node

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo