Skip to content
OpenAdvisories
High WID-SEC-2026-3672 13 CVEs

n8n: Mehrere Schwachstellen

Published Sep 29, 2026 · Updated Oct 14, 2026 · Revision 2 · de-DE

Vendor: n8n Product: n8n Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsmechanismen zu umgehen, um Informationen offenzulegen oder zu manipulieren, sowie um einen Denial of Service herbeizuführen.

Product

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Vulnerabilities 13

  • High 8.2
    CVE-2026-110843

    n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint

    n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticate…

    n8n-io n8n
  • High 7.7
    CVE-2026-110842

    n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter

    n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared p…

    n8n-io n8n
  • High 7.7
    CVE-2026-110845

    n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation

    n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who …

    n8n-io n8n
  • High 7.2
    CVE-2026-110844

    n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows

    n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow …

    n8n-io n8n
  • High 7.2
    CVE-2026-110849

    n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

    n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin…

    n8n-io n8n
  • High 7.2
    CVE-2026-110850

    n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters

    n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in …

    n8n-io n8n
  • High 7.1
    CVE-2026-110853

    n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON

    n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credential…

    n8n-io n8n
  • High 7.0
    CVE-2026-110840

    n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

    n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input s…

    n8n-io n8n
  • High 7.0
    CVE-2026-110846

    n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

    n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiti…

    n8n-io n8n
  • High 7.0
    CVE-2026-110847

    n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter

    n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow auth…

    n8n-io n8n
  • Medium 6.3
    CVE-2026-110852

    n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution

    n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable componen…

    n8n-io n8n
  • Medium 6.1
    CVE-2026-110841

    n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval

    n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list…

    n8n-io n8n
  • Medium 6.1
    CVE-2026-110851

    n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint

    n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which p…

    n8n-io n8n

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-110841, EUVD-2026-101724, CVE-2026-110853, EUVD-2026-101736, CVE-2026-110851, EUVD-2026-101734, CVE-2026-110850, EUVD-2026-101733, CVE-2026-110849, EUVD-2026-101732, CVE-2026-110847, EUVD-2026-101730, CVE-2026-110846, EUVD-2026-101729, CVE-2026-110845, EUVD-2026-101728, CVE-2026-110852, EUVD-2026-101735, CVE-2026-110844, EUVD-2026-101727, CVE-2026-110843, EUVD-2026-101726, CVE-2026-110842, EUVD-2026-101725, CVE-2026-110840, EUVD-2026-101723

  2. #1

    Initiale Fassung

References