SB2026062575 - Multiple vulnerabilities in n8n

Description

This security bulletin contains information about 2 vulnerabilities.

1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource management in the data-table upload endpoint when handling repeated file uploads. A remote user can repeatedly upload files to exhaust temporary disk storage and cause a denial of service.

Files can accumulate in a shared temporary directory until periodic cleanup runs.

2) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to modify folder associations across project authorization boundaries.

The vulnerability exists due to improper authorization in workflow creation when handling a crafted workflow creation request. A remote user can supply a crafted request payload to modify folder associations across project authorization boundaries.

Only instances with multi-project and folder support enabled are vulnerable.

Remediation

Install update from vendor's website.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv
• https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg