Security advisories

medium2026-07-22

CVE-2026-58661-n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

n8n-io/n8n · GHSA-w867-jm58-p9pv

medium2026-07-22

CVE-2026-59253-n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

n8n-io/n8n · GHSA-2xgm-wc4g-5jvg

medium2026-07-22

CVE-2026-59254-n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

n8n-io/n8n · GHSA-2434-3x6q-8r99

medium2026-07-22

CVE-2026-59257-n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

n8n-io/n8n · GHSA-hwmj-qg4v-cvg9

medium2026-07-22

CVE-2026-59259-n8n: External Secrets Permission Bypass via Expression Parser Mismatch

n8n-io/n8n · GHSA-jp7m-xcgx-57qm

medium2026-07-22

n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

n8n-io/n8n · GHSA-pf2q-pxhf-hgmw

medium2026-07-22

n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

n8n-io/n8n · GHSA-hx4h-vr3m-45vh

high2026-07-22

n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

n8n-io/n8n · GHSA-xwx6-jjhv-84p8

high2026-07-22

n8n: Edit Image Node Format Injection Allows Arbitrary File Write

n8n-io/n8n · GHSA-xmc9-4f2h-jf9c

high2026-07-22

n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

n8n-io/n8n · GHSA-cj9h-qx8g-pq2g

high2026-07-22

n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

n8n-io/n8n · GHSA-6qc9-mqvw-jg7x

high2026-07-22

n8n: Expression sandbox escape via arrow-function bodies enabling command execution

n8n-io/n8n · GHSA-gv7g-jm28-cr3m

high2026-07-22

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

n8n-io/n8n · GHSA-2x35-3fw4-9jr4

high2026-07-22

n8n: Authenticated code execution in the n8n Git node

n8n-io/n8n · GHSA-rcv6-pvrj-4xcg

medium2026-07-22

n8n: SSRF Protection Bypass via MCP Client Node

n8n-io/n8n · GHSA-vhf8-cg2h-cg3p

high2026-07-22

n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

n8n-io/n8n · GHSA-gf29-4f56-r2jf

high2026-07-22

n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

n8n-io/n8n · GHSA-64xh-79j6-r5v8

high2026-07-22

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

n8n-io/n8n · GHSA-8342-988q-86cr

high2026-07-22

CVE-2026-65016-n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

n8n-io/n8n · GHSA-35q8-9mj6-wjmf

high2026-07-22

CVE-2026-65591-n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

n8n-io/n8n · GHSA-pm35-fqvh-cq5g