Skip to content
OpenAdvisories
High NCSC-2026-0248 12 CVEs

Kwetsbaarheden verholpen in n8n workflow automation platform

Published Jul 17, 2026 · Updated Jul 17, 2026 · nl

Vendor: n8n Product: n8n

Summary

n8n heeft meerdere kwetsbaarheden verholpen in het n8n workflow automation platform, specifiek in versies voor 2.10.1, 2.9.3, 1.123.22 en andere gerelateerde releases.

Details

Interpretaties
De kwetsbaarheden betreffen verschillende componenten binnen n8n, waaronder de Form nodes, Python Code node, JavaScript Task Runner sandbox, Merge node, Read/Write Files from Disk node, workflow expression evaluatie, core workflow editing functionaliteit, GitHub Webhook Trigger node, ZendeskTrigger node, Guardrail node en Chat Trigger node.

- Ongeauthenticeerde en geauthenticeerde gebruikers kunnen onder bepaalde voorwaarden arbitrary code injecteren en uitvoeren, soms via sandbox escapes, wat leidt tot remote code execution op het host-systeem.
- Kwetsbaarheden in nodes zoals Merge node en Read/Write Files from Disk node stellen geauthenticeerde gebruikers met workflow bewerkingsrechten in staat om bestanden te schrijven en shell-commando's uit te voeren.
- Webhook nodes (GitHub en ZendeskTrigger) missen HMAC-SHA256 handtekening verificatie, waardoor onbevoegde POST-requests kunnen worden verzonden die workflows triggeren.
- Authenticatie bypass kwetsbaarheden in SSO en Chat Trigger nodes maken het mogelijk om beveiligingsmechanismen te omzeilen en ongeautoriseerde toegang te verkrijgen.
- Input validatie in de Guardrail node kan worden omzeild, wat de integriteit van workflows kan aantasten.

Deze kwetsbaarheden zijn aanwezig in meerdere versies en releases van n8n en zijn gerelateerd aan workflow creatie, modificatie en uitvoering, waarbij misbruik kan leiden tot het overnemen van het host-systeem, het manipuleren van workflows en het omzeilen van authenticatiecontroles.

Oplossingen
n8n heeft updates uitgebracht in versies 2.10.1, 2.9.3, 1.123.22, 2.8.0, 1.123.15, 2.5.0, 1.123.18, 2.6.2 en 2.10.0 om de genoemde kwetsbaarheden te verhelpen. Voor omgevingen waar directe upgrade niet mogelijk is, zijn tijdelijke mitigaties beschikbaar, zoals het beperken van gebruikersrechten en het uitschakelen van bepaalde nodes. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 12

  • Critical 9.5
    CVE-2026-27493

    n8n has Unauthenticated Expression Evaluation via Form Node

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n …

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-27495 Public exploit

    n8n has a Sandbox Escape in its JavaScript Task Runner

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary cod…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-27497

    n8n has Potential Remote Code Execution via Merge Node

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could leverage the Merge node's SQL query mode to execute arbitrary code and write arbitrary…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-27577 Public exploit EPSS 11%

    n8n: Expression Sandbox Escape Leads to RCE

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to crea…

    n8n-io n8n n8n npm
  • Critical 9.0
    CVE-2026-27498

    n8n has Arbitrary Command Execution via File Write and Git Operations

    n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. …

    n8n-io n8n n8n npm
  • High 8.5
    CVE-2026-27578

    n8n Vulnerable to Stored XSS via Various Nodes

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different te…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-27494

    n8n has Arbitrary File Read via Python Code Node Sandbox Escape

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the Python Code node to escape the sandbox. The sandbox did not sufficiently restr…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-56349

    n8n - Guardrail Node Bypass via Crafted Input

    n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integri…

    n8n n8n n8n npm
  • Medium 6.3
    CVE-2026-56350

    n8n - SSO Enforcement Bypass via API

    n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and i…

    n8n n8n n8n npm
  • Medium 4.8
    CVE-2026-56353

    n8n - Authentication Bypass in Chat Trigger Node

    n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger we…

    n8n n8n n8n npm
  • Medium 4.0
    CVE-2026-56357

    n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

    n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with …

    n8n n8n n8n npm
  • Medium 4.0
    CVE-2026-56360

    n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

    n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

    n8n n8n n8n npm

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-fvfv-ppw4-7h2w
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-jh8h-6c9q-7gmw
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-jjpj-p2wh-qf23
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-mmgg-m5j7-f83h
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-mqpr-49jj-32rc
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-wxx7-mcgf-j869
  • Reference
    https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq