Skip to content
OpenAdvisories
High WID-SEC-2026-4192 12 CVEs

n8n: Mehrere Schwachstellen

Published Oct 27, 2026 · Updated Nov 12, 2026 · Revision 3 · de

Vendor: n8n Product: n8n Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.

Vulnerabilities 12

  • High 8.8
    CVE-2026-119408

    n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes

    n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or…

    n8n-io n8n
  • High 8.2
    CVE-2026-126383

    n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key

    n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming…

    n8n-io n8n
  • High 7.5
    CVE-2026-126384

    n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node

    n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted unt…

    n8n-io n8n
  • High 7.5
    CVE-2026-126391

    n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape

    n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected …

    n8n-io n8n
  • Medium 6.3
    CVE-2026-126382

    n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accept…

    n8n-io n8n
  • Medium 6.3
    CVE-2026-126389

    n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated att…

    n8n-io n8n
  • Medium 6.3
    CVE-2026-126390

    n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API…

    n8n-io n8n
  • Medium 5.3
    CVE-2026-126387

    n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool

    n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright re…

    n8n-io n8n
  • Medium 5.1
    CVE-2026-126386

    n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerabil…

    n8n-io n8n
  • Medium 4.9
    CVE-2026-126381

    n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Sto…

    n8n-io n8n
  • Medium 4.8
    CVE-2026-126385

    n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the …

    n8n-io n8n
  • Low 3.7
    CVE-2026-126388

    n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes

    n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or a…

    n8n-io n8n

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-126385, EUVD-2026-125180, CVE-2026-126387, EUVD-2026-125178, CVE-2026-126381, EUVD-2026-125184, CVE-2026-126384, EUVD-2026-125181, CVE-2026-126383, EUVD-2026-125182, CVE-2026-126382, EUVD-2026-125183, CVE-2026-126386, EUVD-2026-125179, CVE-2026-126390, EUVD-2026-125175, CVE-2026-126389, EUVD-2026-125176, CVE-2026-126391, EUVD-2026-125174, CVE-2026-126388, EUVD-2026-125177

  2. #2

    Referenz(en) aufgenommen: CVE-2026-119408, EUVD-2026-113792

  3. #1

    Initiale Fassung

References