Skip to content
OpenAdvisories
High NCSC-2026-0212 14 CVEs

Kwetsbaarheden verholpen in n8n workflow automation platform

Published Jun 29, 2026 · Updated Jun 29, 2026 · nl

Vendor: n8n Product: n8n

Summary

n8n heeft meerdere kwetsbaarheden verholpen in het n8n workflow automation platform, specifiek in versies voor 1.123.55, 2.24.0, 2.25.7, 2.26.1 en 2.26.2.

Details

Interpretaties
De kwetsbaarheden bereffen verschillende onderdelen van het n8n platform. Geuthenticeerde gebruikers met workflow bewerkingsrechten kunnen onder andere Content-Security-Policy (CSP) omzeilen via de Respond to Webhook node, en JavaScript injecteren via de Chat Trigger node. Verder kunnen zij API-tokens exfiltreren via de SecurityScorecard node en credentials van andere gebruikers benaderen, overschrijven of intrekken via de Dynamic Credentials feature. Ook kunnen gebruikers met editor toegang tot gedeelde workflows credentials van anderen inzien door onvoldoende eigendomcontroles.

Ongeauthenticeerde aanvallers kunnen via de MicrosoftAgent365Trigger en StripeTrigger nodes valse payloads indienen, wat leidt tot uitvoering van workflows met kwaadaardige data.

Oplossingen
n8n heeft updates uitgebracht in versies 1.123.55, 2.24.0, 2.25.7, 2.26.1 en 2.26.2 om de genoemde kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 14

  • High 8.9
    CVE-2026-54305

    n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

    n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope checks on the targe…

    n8n-io n8n n8n npm
  • High 8.8
    CVE-2026-54309

    n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

    n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable…

    n8n-io n8n n8n npm
  • High 8.5
    CVE-2026-54307

    n8n: Credential Exfiltration via Permission Bypass

    n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks w…

    n8n-io n8n n8n npm
  • High 7.2
    CVE-2026-54312

    n8n: Microsoft SQL Node Prototype Pollution

    n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. T…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-54304

    n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

    n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the Securi…

    n8n-io n8n n8n npm
  • High 7.0
    CVE-2026-54301

    n8n: Same-Origin XSS in Respond to Webhook Node

    n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary r…

    n8n-io n8n n8n npm
  • High 7.0
    CVE-2026-54302

    n8n: Stored XSS in Chat Trigger Node

    n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When a logged…

    n8n-io n8n n8n npm
  • Medium 6.8
    CVE-2026-54303

    n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

    n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in…

    n8n-io n8n n8n npm
  • Medium 6.5
    CVE-2026-54310

    n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

    n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to…

    n8n-io n8n n8n npm
  • Medium 6.5
    CVE-2026-54313

    n8n: NoSQL Injection in MongoDB Node Find And Replace Operation

    n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to Mon…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-54306

    n8n: Prototype Pollution enables confused-deputy execution via public webhooks

    n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields c…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-54308

    n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node

    n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forge…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-54314

    n8n: Denial of Service via ZIP decompression in webhook workflow

    n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a s…

    n8n-io n8n n8n npm
  • Medium 6.0
    CVE-2026-54311

    n8n: Merge Node SQL Mode Prototype Pollution

    n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and r…

    n8n-io n8n n8n npm

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-2j5h-858j-5mpf
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-42h7-m79w-wvg5
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-664h-gpgq-h6xx
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-9c38-2mcm-q7f7
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-hv7x-3x78-gx53
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-jwm3-qcfw-c5pp
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-pmqw-72cg-wx85
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-rm2v-h48j-895m
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-x6p3-m6h9-fx7r