SB2026051385 - Multiple vulnerabilities in n8n

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026051385

SB2026051385 - Multiple vulnerabilities in n8n

Published: May 13, 2026

Security Bulletin ID SB2026051385
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 60% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Prototype pollution (CVE-ID: CVE-2026-44791)

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to prototype pollution in the XML node when creating or modifying workflows. A remote user can bypass the existing patch and combine the XML node with other nodes to execute arbitrary code.

Exploitation requires permission to create or modify workflows.


2) SQL injection (CVE-ID: CVE-2026-44792)

The vulnerability allows a remote attacker to execute arbitrary SQL commands on the internal PostgreSQL instance.

The vulnerability exists due to SQL injection in the Source Control pull import of Data Table JSON files when processing a crafted column name from a pulled repository. A remote attacker can commit a malicious Data Table JSON file and trigger execution during a Source Control Pull to execute arbitrary SQL commands on the internal PostgreSQL instance.

Exploitation requires the Source Control feature to be enabled, the instance to use PostgreSQL as its database backend, and an administrator to perform a Source Control Pull.


3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-45732)

The vulnerability allows a remote user to overwrite stored OAuth token material for a shared credential.

The vulnerability exists due to improper access control in the OAuth1 and OAuth2 credential reconnect endpoints when handling OAuth reconnect requests for shared credentials. A remote user can initiate an OAuth reconnect flow to overwrite stored OAuth token material for a shared credential.

This issue affects instances where credentials are shared with other users or across projects.


4) Prototype pollution (CVE-ID: CVE-2026-44789)

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the HTTP Request node pagination parameter when processing pagination input. A remote user can supply a crafted pagination parameter to execute arbitrary code.

Exploitation requires permission to create or modify workflows.


5) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-44790)

The vulnerability allows a remote user to read arbitrary files from the n8n server, potentially leading to full compromise.

The vulnerability exists due to improper neutralization of argument delimiters in the Git node Push operation when processing injected CLI flags. A remote user can inject CLI flags through a workflow to read arbitrary files from the n8n server, potentially leading to full compromise.

Exploitation requires permission to create or modify workflows.


Remediation

Install update from vendor's website.

References