Skip to content
OpenAdvisories
High WID-SEC-2026-3393 17 CVEs

n8n: Mehrere Schwachstellen

Published Sep 15, 2026 · Updated Nov 1, 2026 · Revision 4 · de-DE

Vendor: n8n Product: n8n Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Code auszuführen.

Product

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Vulnerabilities 17

  • Critical 9.0
    CVE-2026-103248

    n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrust…

    n8n-io n8n
  • Critical 9.0
    CVE-2026-103255

    n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows bi…

    n8n-io n8n
  • High 8.7
    CVE-2026-103253

    n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append …

    n8n-io n8n
  • High 8.5
    CVE-2026-103247

    n8n before 1.123.80 Credential Tampering via Duplicate Node IDs

    n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim …

    n8n-io n8n
  • High 8.1
    CVE-2026-103250

    n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query op…

    n8n-io n8n
  • High 7.7
    CVE-2026-103246

    n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts wi…

    n8n-io n8n
  • High 7.7
    CVE-2026-103252

    n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify …

    n8n-io n8n
  • High 7.7
    CVE-2026-103257

    n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unint…

    n8n-io n8n
  • High 7.6
    CVE-2026-103249

    n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute …

    n8n-io n8n
  • High 7.6
    CVE-2026-103259

    n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a…

    n8n-io n8n
  • High 7.1
    CVE-2026-103251

    n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validat…

    n8n-io n8n
  • High 7.1
    CVE-2026-103256

    n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can mod…

    n8n-io n8n
  • Medium 6.8
    CVE-2026-103258

    n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit thi…

    n8n-io n8n
  • Medium 6.3
    CVE-2026-103254

    n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs…

    n8n-io n8n
  • Medium 5.9
    CVE-2026-119557

    n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node

    n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and…

    n8n-io n8n
  • Medium 5.3
    CVE-2026-103245

    n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled …

    n8n-io n8n
  • Medium 4.0
    CVE-2026-103260

    n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, a…

    n8n-io n8n

Revision history

  1. #4

    Referenz(en) aufgenommen: CVE-2026-119557, EUVD-2026-113822

  2. #3

    Referenz(en) aufgenommen: CVE-2026-103255, EUVD-2026-90649, CVE-2026-103245, EUVD-2026-90749

  3. #2

    Referenz(en) aufgenommen: CVE-2026-103249, EUVD-2026-90643, CVE-2026-103254, EUVD-2026-90648, CVE-2026-103252, EUVD-2026-90646, CVE-2026-103251, EUVD-2026-90645, CVE-2026-103248, EUVD-2026-90642, CVE-2026-103250, EUVD-2026-90644, CVE-2026-103247, EUVD-2026-90751, CVE-2026-103246, EUVD-2026-90750, CVE-2026-103260, EUVD-2026-90654, CVE-2026-103259, EUVD-2026-90653, CVE-2026-103258, EUVD-2026-90652, CVE-2026-103257, EUVD-2026-90651, CVE-2026-103256, EUVD-2026-90650, CVE-2026-103253, EUVD-2026-90647

  4. #1

    Initiale Fassung

References