Skip to content
OpenAdvisories
High WID-SEC-2026-2067 9 CVEs

n8n: Mehrere Schwachstellen

Published Jun 24, 2026 · Updated Jul 15, 2026 · Revision 5 · de-DE

Vendor: n8n Product: n8n Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.

Product

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Vulnerabilities 9

  • High 7.6
    CVE-2026-59208

    n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

    n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and igno…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-59206

    n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

    n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflo…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-59207

    n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

    n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-le…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-59209

    n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

    n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request…

    n8n-io n8n n8n npm
  • Medium 6.3
    CVE-2026-59254

    n8n - External Secrets Disclosure via Workflow Node Expressions

    n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing t…

    n8n n8n n8n npm
  • Medium 6.0
    CVE-2026-59259

    n8n - Permission Bypass via Expression Parser Mismatch in External Secrets

    n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create o…

    n8n n8n n8n npm
  • Medium 5.3
    CVE-2026-58661

    n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint

    n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing…

    n8n n8n n8n npm
  • Medium 5.3
    CVE-2026-59253

    n8n - Improper Authorization in Workflow Assignment to Folders

    n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during wor…

    n8n n8n n8n npm
  • Medium 5.3
    CVE-2026-59257

    n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation

    n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string with…

    n8n n8n n8n npm

Revision history

  1. #5

    Referenz(en) aufgenommen: CVE-2026-59254, EUVD-2026-44634, CVE-2026-59259, EUVD-2026-44635

  2. #4

    Referenz(en) aufgenommen: CVE-2026-58661, EUVD-2026-42893

  3. #3

    Referenz(en) aufgenommen: CVE-2026-59209, EUVD-2026-42613, CVE-2026-59208, EUVD-2026-42610, CVE-2026-59206, EUVD-2026-42612, CVE-2026-59207, EUVD-2026-42609

  4. #2

    Referenz(en) aufgenommen: CVE-2026-59253, EUVD-2026-42268, CVE-2026-59257, EUVD-2026-42269

  5. #1

    Initiale Fassung

References