Skip to content
OpenAdvisories
High WID-SEC-2026-3898 14 CVEs

n8n: Mehrere Schwachstellen

Published Oct 13, 2026 · Updated Oct 28, 2026 · Revision 2 · de-DE

Vendor: n8n Product: n8n Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder Denial-of-Service-Zustände herbeizuführen.

Product

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Vulnerabilities 14

  • High 8.7
    CVE-2026-118645

    n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

    n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data u…

    n8n-io n8n
  • High 8.3
    CVE-2026-118649

    n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

    n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member w…

    n8n-io n8n
  • High 8.2
    CVE-2026-118643

    n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data

    n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cann…

    n8n-io n8n
  • High 8.2
    CVE-2026-118647

    n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data

    n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential…

    n8n-io n8n
  • High 7.7
    CVE-2026-118644

    n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

    n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to a…

    n8n-io n8n
  • High 7.5
    CVE-2026-118641

    n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

    n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-binda…

    n8n-io n8n
  • High 7.3
    CVE-2026-118648

    n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy

    n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authent…

    n8n-io n8n
  • High 7.1
    CVE-2026-118642

    n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can …

    n8n-io n8n
  • High 7.1
    CVE-2026-118675

    n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow …

    n8n-io n8n
  • High 7.1
    CVE-2026-118676

    n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip cre…

    n8n-io n8n
  • High 7.1
    CVE-2026-118678

    n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

    n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to w…

    n8n-io n8n
  • Medium 6.5
    CVE-2026-118646

    n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy F…

    n8n-io n8n
  • Medium 5.9
    CVE-2026-118677

    n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance

    n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the…

    n8n-io n8n
  • Medium 5.4
    CVE-2026-118640

    n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the global:chatUser role can add and run tools through chat to execute sandboxed code,…

    n8n-io n8n

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-118675, EUVD-2026-112381, CVE-2026-118678, EUVD-2026-112384, CVE-2026-118649, EUVD-2026-112380, CVE-2026-118644, GHSA-CFC8-9WGC-86CF, CVE-2026-118647, EUVD-2026-112378, CVE-2026-118646, EUVD-2026-112377, CVE-2026-118640, EUVD-2026-112371, CVE-2026-118648, EUVD-2026-112379, CVE-2026-118643, EUVD-2026-112374, CVE-2026-118645, EUVD-2026-112376, CVE-2026-118642, EUVD-2026-112373, CVE-2026-118676, EUVD-2026-112382, CVE-2026-118641, EUVD-2026-112372, CVE-2026-118677, EUVD-2026-112383

  2. #1

    Initiale Fassung

References