SB20260917256 - Multiple vulnerabilities in n8n

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260917256

SB20260917256 - Multiple vulnerabilities in n8n

Published: September 17, 2026

Security Bulletin ID SB20260917256
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 20% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject forged events into workflows.

The vulnerability exists due to improper verification of cryptographic signatures in the Webflow Trigger node webhook handler when handling HTTP POST requests to the webhook URL. A remote attacker can send a forged request to inject forged events into workflows.


2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in inline agent node-tool input schema resolution when registering a node tool on an inline agent. A remote user can specify an arbitrary instance credential ID and send its plaintext secret to a host of their choosing to disclose sensitive information.

Credential IDs may be available in workflow JSON, exports, and editor URLs.


3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose credentials.

The vulnerability exists due to improper authorization in the workflow credential tamper guard when saving a shared workflow containing nodes with duplicate IDs. A remote attacker can create nodes sharing an ID to disclose credentials.

Exploitation requires a workflow shared with an editor.


4) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, modify, or delete database records.

The vulnerability exists due to improper neutralization of special elements in the Supabase node\'s Filters (String) mode when constructing database queries. A remote attacker can submit a crafted filter expression to read, update, or delete unintended rows.

Exploitation requires a workflow that constructs the filter from untrusted input.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the editor origin.

The vulnerability exists due to improper URL scheme validation in Resource Locator dropdown link handling when processing stored Resource Locator URLs. A remote user can set a Resource Locator parameter to a script URL in a workflow to execute arbitrary JavaScript in the editor origin.

User interaction is required to open the node\'s dropdown and click the external-link icon.


6) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: N/A)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, modify, or delete other users\' conversation histories.

The vulnerability exists due to improper neutralization of special elements in a MongoDB query in the MongoDB Chat Memory node when processing sessionId values from Chat Trigger request bodies. A remote attacker can submit a MongoDB query operator in place of a session identifier to read, modify, or delete other users\' conversation histories.

Only workflows that combine an unauthenticated Chat Trigger node with a MongoDB Chat Memory node are affected.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to install and load arbitrary npm packages on every instance in an n8n cluster.

The vulnerability exists due to improper authorization in the internal community package installation handler when processing PubSub messages through Redis in queue mode. A remote user can write a crafted message to the Redis instance to install and load an arbitrary npm package.

No n8n account is required.


8) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the credential test endpoint when resolving project-scoped workflow variables using a project ID supplied in the request body. A remote user can submit a credential test request specifying an arbitrary project and a controlled destination to disclose sensitive information.


9) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify or delete database data.

The vulnerability exists due to SQL injection in the Oracle Database node Delete Table → Drop operation when processing table or schema values bound to untrusted upstream data. A remote attacker can supply crafted values containing SQL to modify or delete database data.

Injected statements execute with the privileges of the connected database credential.


10) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to forge approval decisions across projects.

The vulnerability exists due to path traversal in signed resume URL generation when resolving caller-controlled node IDs. A remote user can save a workflow containing traversal sequences in a node ID to forge approval decisions across projects.

Generated approval URLs remain valid for future workflow executions.


Remediation

Install update from vendor's website.

References