SB2026072262 - Multiple vulnerabilities in n8n

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072262

SB2026072262 - Multiple vulnerabilities in n8n

Published: July 22, 2026

Security Bulletin ID SB2026072262
CSH Severity
High
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Privilege escalation

Breakdown by Severity

High 6% Medium 50% Low 44%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 vulnerabilities.


1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the Edit Fields (Set) node when assigning output fields through dot-notation field names. A remote user can name a field after an inherited built-in method path to cause a denial of service.

The issue can corrupt a shared global in the main Node.js process, causing authenticated requests to fail until the process is restarted.


2) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform SQL injection.

The vulnerability exists due to SQL injection in the Snowflake node executeQuery operation when interpolating untrusted expression values directly into a raw SQL query string. A remote user can embed crafted expression data into a query to perform SQL injection.

Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw SQL query.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to write arbitrary files.

The vulnerability exists due to improper input validation in the Edit Image node when processing a user-supplied output format value. A remote user can provide a crafted format value to write arbitrary files.

Exploitation requires the ability to run workflows.


4) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive credentials.

The vulnerability exists due to improper access control in the Execute Sub-workflow node's inline workflow JSON handling when validating credential references in shared workflows. A remote user can reference a credential inside inline sub-workflow JSON to disclose sensitive credentials.

Exploitation requires workflow sharing to be enabled, editor access to a shared workflow, and knowledge of the target credential ID.


5) Exposure of Resource to Wrong Sphere (CVE-ID: N/A)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to alter other users' code-node executions and affect their confidentiality, integrity, or availability.

The vulnerability exists due to improper isolation in the js task runner module cache when processing code-node executions on a shared runner. A remote user can poison a cached module to alter other users' code-node executions and affect their confidentiality, integrity, or availability.

This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the js task runner with built-in or external modules enabled are vulnerable.


6) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute system commands.

The vulnerability exists due to improper access control in the expression sandbox when evaluating crafted expressions with arrow-function bodies. A remote user can create or modify a workflow containing a crafted expression to execute system commands.

Exploitation requires permission to create or modify workflows.


7) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in the Send Email node message body handling when processing untrusted workflow expression values in the text or HTML body field. A remote attacker can supply a specially crafted non-string value to disclose sensitive information.

Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the Send Email node, and untrusted input mapped directly into the text or HTML body field.


8) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the Git node when executing workflows that stage a crafted local repository under the default git security settings. A remote user can create and execute a workflow using the Git node to execute arbitrary code.

Exploitation causes git to run hooks as the n8n process user.


9) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information from internal or otherwise blocked hosts.

The vulnerability exists due to improper access control in the MCP Client node when sending requests to a user-supplied endpoint. A remote user can create or edit a workflow that causes the server to connect to internal or otherwise blocked hosts and read the responses back through the workflow to disclose sensitive information from internal or otherwise blocked hosts.

Only instances with SSRF protection enabled are vulnerable.


10) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the VM expression engine sandbox when creating or editing a workflow expression that uses array-element access. A remote user can obtain a reference to a host built-in and pollute its prototype to cause a denial of service.

Only instances running the VM expression engine are vulnerable.


11) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the Git node fetch, pull, and push-tags operations when processing an allowlisted remote configuration value that points to a local path outside the intended sandbox. A remote user can configure a local path outside the sandbox and pull an arbitrary local git repository into the workspace to disclose sensitive information.

Exploitation requires workflow create and execute rights.


12) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in multiple AI and LLM nodes when processing user-supplied base or endpoint URLs. A remote user can point a node to an attacker-controlled host to disclose sensitive information.

Only instances where a credential has "Allowed HTTP Request Domains" configured and is shared with non-owner users are vulnerable.


13) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to take over arbitrary user accounts.

The vulnerability exists due to improper authentication in the token exchange embed login feature when matching a validly signed incoming token to a local account by its email claim. A remote user can supply a token accepted by a configured trusted key source with an unverified email claim to take over arbitrary user accounts.

Only instances with the embed login feature enabled and at least one trusted key source configured are vulnerable.


14) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the @n8n/computer-use search_files tool when processing a crafted search pattern. A remote user can supply a crafted search pattern to disclose sensitive information.

The issue can expose the names and contents of files outside the intended base directory, limited to files readable by the daemon's OS user.


15) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the HTTP Request node genericAuthType credential authorization check when processing an expression-based credential type. A remote user can reference another user's credential identifier in a shared workflow to disclose sensitive information.

Exploitation requires edit access to a shared workflow and knowledge of the target credential's identifier.


16) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary SQL on connected PostgreSQL instances.

The vulnerability exists due to sql injection in the Postgres Trigger node when processing user-supplied identifier parameters. A remote user can supply crafted channel, function, or trigger names to execute arbitrary SQL on connected PostgreSQL instances.

Injected SQL is executed with the privileges of the configured PostgreSQL credentials, which can result in full read and write access to the connected database.


Remediation

Install update from vendor's website.

References