Skip to content
OpenAdvisories
High WID-SEC-2026-0532 12 CVEs

n8n: Mehrere Schwachstellen

Published Feb 25, 2026 · Updated Jul 15, 2026 · Revision 5 · de-DE

Vendor: n8n Product: n8n Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren, um einen SQL-Injection Angriff durchzuführen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Vulnerabilities 12

  • Critical 9.5
    CVE-2026-27493

    n8n has Unauthenticated Expression Evaluation via Form Node

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n …

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-27495 Public exploit

    n8n has a Sandbox Escape in its JavaScript Task Runner

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary cod…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-27497

    n8n has Potential Remote Code Execution via Merge Node

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could leverage the Merge node's SQL query mode to execute arbitrary code and write arbitrary…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-27577 Public exploit EPSS 11%

    n8n: Expression Sandbox Escape Leads to RCE

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to crea…

    n8n-io n8n n8n npm
  • Critical 9.0
    CVE-2026-27498

    n8n has Arbitrary Command Execution via File Write and Git Operations

    n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. …

    n8n-io n8n n8n npm
  • High 8.5
    CVE-2026-27578

    n8n Vulnerable to Stored XSS via Various Nodes

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different te…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-27494

    n8n has Arbitrary File Read via Python Code Node Sandbox Escape

    n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the Python Code node to escape the sandbox. The sandbox did not sufficiently restr…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-56349

    n8n - Guardrail Node Bypass via Crafted Input

    n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integri…

    n8n n8n n8n npm
  • Medium 6.3
    CVE-2026-56350

    n8n - SSO Enforcement Bypass via API

    n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and i…

    n8n n8n n8n npm
  • Medium 4.8
    CVE-2026-56353

    n8n - Authentication Bypass in Chat Trigger Node

    n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger we…

    n8n n8n n8n npm
  • Medium 4.0
    CVE-2026-56357

    n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

    n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with …

    n8n n8n n8n npm
  • Medium 4.0
    CVE-2026-56360

    n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

    n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

    n8n n8n n8n npm

Revision history

  1. #5

    Referenz(en) aufgenommen: CVE-2026-56349, EUVD-2026-44624, CVE-2026-56353, EUVD-2026-44626

  2. #4

    Referenz(en) aufgenommen: CVE-2026-56360, EUVD-2026-42258

  3. #3

    Referenz(en) aufgenommen: CVE-2026-56350, EUVD-2026-40443

  4. #2

    CVE ergänzt

  5. #1

    Initiale Fassung

References