Skip to content
OpenAdvisories
High WID-SEC-2026-0877 13 CVEs

n8n: Mehrere Schwachstellen

Published Mar 25, 2026 · Updated Jul 12, 2026 · Revision 5 · de-DE

Vendor: n8n Product: n8n Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um erweiterte Privilegien, einschließlich Administratorrechte, zu erlangen, um beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Cross-Site- und Man-in-the-Middle-Angriffe durchzuführen.

Product

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Vulnerabilities 13

  • Critical 9.4
    CVE-2026-33660

    n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

    n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use the Merge node's "Combine by SQL" mode to read local files on the n8n host and ac…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-33696

    n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE

    n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the XML and the GSuiteAdmin nodes. By …

    n8n-io n8n n8n npm
  • High 8.8
    CVE-2026-33665

    n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover

    n8n is an open source workflow automation platform. Prior to versions 2.4.0 and 1.121.0, when LDAP authentication is enabled, n8n automatically linked an LDAP identity to an existing local account if the LDAP email attribute matched the local account's email.…

    n8n-io n8n n8n npm
  • High 8.5
    CVE-2026-33663

    n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

    n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with the `global:member` role could exploit chained authorization flaws in n8n's credential pipeline to steal plaintext secrets from gene…

    n8n-io n8n n8n npm
  • High 7.3
    CVE-2026-33722

    n8n Has External Secrets Authorization Bypass in Credential Saving

    n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when sav…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-27496

    n8n has In-Process Memory Disclosure in its Task Runner

    n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-33720

    n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK

    n8n is an open source workflow automation platform. Prior to version 2.8.0, when the `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK` environment variable is set to `true`, the OAuth callback handler skips ownership verification of the OAuth state parameter. This allows an …

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-33724

    n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

    n8n is an open source workflow automation platform. Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for git operations explicitly disabled host key verification. A network attacker positioned between the …

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-33749

    n8n Vulnerable to XSS via Binary Data Inline HTML Rendering

    n8n is an open source workflow automation platform. Prior to versions 1.123.27, 2.13.3, and 2.14.1, an authenticated user with permission to create or modify workflows could craft a workflow that produces an HTML binary data object without a filename. The `/r…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-33751

    n8n Vulnerable to LDAP Filter Injection in LDAP Node

    n8n is an open source workflow automation platform. Prior to versions 1.123.27, 2.13.3, and 2.14.1, a flaw in the LDAP node's filter escape logic allowed LDAP metacharacters to pass through unescaped when user-controlled input was interpolated into LDAP searc…

    n8n-io n8n n8n npm
  • Medium 5.4
    CVE-2026-56356

    n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field

    n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123…

    n8n n8n n8n npm
  • Medium 5.4
    CVE-2026-56359

    n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL

    n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and tric…

    n8n n8n n8n npm
  • Medium 4.1
    CVE-2026-56354

    n8n - Cross-Site Scripting and Open Redirect in Form Node

    n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated …

    n8n n8n n8n npm

Revision history

  1. #5

    Referenz(en) aufgenommen: CVE-2026-56354, EUVD-2026-42887

  2. #4

    Referenz(en) aufgenommen: CVE-2026-56359, EUVD-2026-42257

  3. #3

    Referenz(en) aufgenommen: CVE-2026-56356, EUVD-2026-40444

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-38754

  5. #1

    Initiale Fassung

References