SB2026101463 - Multiple vulnerabilities in n8n

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101463

SB2026101463 - Multiple vulnerabilities in n8n

Published: October 14, 2026 Updated: November 13, 2026

Security Bulletin ID SB2026101463
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-118640)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access and modify instance resources beyond the permissions of their role.

The vulnerability exists due to improper authorization in Chat Hub tool registration when registering tools for users with the chat user role. A remote user can register insufficiently restricted tool types and run them through a chat to access and modify instance resources beyond the permissions of their role.

Code execution through these tools occurs in the task runner sandbox, and file operations are limited to directories allowed by n8n.


2) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-118641)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose the bound mailbox's entire contact list.

The vulnerability exists due to improper neutralization of query syntax in the Microsoft Outlook node's contact lookup when constructing an OData $filter string literal from an expression-bound parameter. A remote user can supply a value containing a single quote that closes the literal and rewrites the query to disclose the bound mailbox's entire contact list.

Exploitation requires a workflow that binds untrusted input into the affected parameter. Access remains within the scope of the stored credential.


3) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: N/A)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify a SharePoint list item that the workflow did not intend to update.

The vulnerability exists due to improper neutralization of query syntax in the Microsoft SharePoint v1 node's pre-write item lookup when constructing an OData $filter string literal from an expression-bound parameter. A remote user can supply a value containing a single quote that closes the literal and redirects the lookup to modify a SharePoint list item that the workflow did not intend to update.

Exploitation requires a workflow that binds untrusted input into the affected parameter. The node writes the submitted field values, and access remains within the scope of the stored credential.


4) Incorrect authorization (CVE-ID: CVE-2026-118642)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose decrypted credentials they are not authorized to access.

The vulnerability exists due to inconsistent authorization checks in credential permission checking for inline sub-workflow nodes when processing nodes with a non-boolean disabled value. A remote user can craft and execute an inline sub-workflow containing a node that bypasses credential permission checking and sends the decrypted credential to a server they control to disclose decrypted credentials they are not authorized to access.

Exploitation requires knowing the identifier of a credential the user cannot access.


5) Information Exposure Through an Error Message (CVE-ID: CVE-2026-118643)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose a Git credential password or token.

The vulnerability exists due to inclusion of sensitive credential information in error data in the Git node when an operation fails. A remote user can read the stored execution error data to disclose a Git credential password or token.

Exploitation requires permission to view the workflow's executions, but does not require permission to read the credential.


6) Information Exposure Through an Error Message (CVE-ID: N/A)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose a MongoDB database password.

The vulnerability exists due to inclusion of sensitive credential information in error data in the MongoDB Atlas Vector Store node when an operation fails. A remote user can read the stored execution error data to disclose a MongoDB database password.

Exploitation requires permission to view the workflow's executions, but does not require permission to read the credential.


7) Information Exposure Through an Error Message (CVE-ID: N/A)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose a Google access token.

The vulnerability exists due to inclusion of sensitive credential information in error data in the Google Cloud Storage node when an operation fails. A remote user can read the stored execution error data to disclose a Google access token.

Exploitation requires permission to view the workflow's executions, but does not require permission to read the credential.


8) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-118645)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read or delete all records in a Quick Base table.

The vulnerability exists due to improper neutralization of filter input in the Quick Base node when building Where filters from untrusted input and sending them as raw query text to the Quick Base API. A remote user can supply crafted input that changes the filter logic to read or delete all records in a Quick Base table.

The affected operations are Get Many and Delete, which execute with the privileges of the workflow's credential.


9) Inefficient regular expression complexity (CVE-ID: CVE-2026-118646)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to excessive regular expression backtracking in the Read/Write Files from Disk node when evaluating file selector glob patterns on the main event loop without a time limit. A remote user can submit a selector containing many wildcards to cause a denial of service.

Exploitation requires permission to create and run workflows. The UI, API, webhooks and health checks stop responding until the process is restarted.


10) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-118647)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose the SeaTable API token and access the connected SeaTable base.

The vulnerability exists due to storage of sensitive information in error execution records in the SeaTable Trigger node when a polling request for a base access token fails. A remote user can read the saved HTTP error, including the Authorization header, to disclose the SeaTable API token and access the connected SeaTable base.

Exploitation requires permission to view the workflow's executions, but does not require permission to read its credential.


11) Cross-site scripting (CVE-ID: CVE-2026-118648)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary scripts on the n8n origin using another user's session.

The vulnerability exists due to failure to apply the sandbox content security policy in webhook response handling when returning error responses or certain responses without headers. A remote user can serve workflow-generated HTML containing malicious scripts through a webhook URL to execute arbitrary scripts on the n8n origin using another user's session.

Exploitation requires permission to create and activate workflows and another user to open the webhook URL.


12) Incorrect authorization (CVE-ID: CVE-2026-118649)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to list, read, modify and delete Data Table rows across all projects in the instance.

The vulnerability exists due to incorrect authorization in Data Table project checks when resolving workflow ownership through an in-memory cache keyed by client-supplied workflow IDs. A remote user can supply a specially crafted workflow ID that causes the cache to return an invalid owner project and the project check to match every project to list, read, modify and delete Data Table rows across all projects in the instance.

Exploitation requires permission to create and run workflows.


13) SQL injection (CVE-ID: CVE-2026-126381)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to read data accessible to the configured Oracle credential through SQL injection.

The vulnerability exists due to missing validation of Metadata Filter keys in n8n's Vector Store (OracleDB) node when workflows pass untrusted input into those keys. An authenticated attacker can submit a crafted filter key through an input source such as a webhook to alter the vector search query and retrieve database data.


14) Incorrect authorization (CVE-ID: CVE-2026-118675)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated editor of a shared workflow to obtain decrypted credentials belonging to the workflow's project without authorization.

The vulnerability exists due to n8n's save-time credential checks not inspecting sub-workflows loaded at runtime by the Execute Sub-workflow node from a URL or local file. An authenticated editor of a shared workflow can supply such a sub-workflow to resolve project credentials and receive their decrypted values.


15) Incorrect authorization (CVE-ID: CVE-2026-118676)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with member privileges to steal credentials they are not authorized to access.

The vulnerability exists due to n8n's credential permission check evaluating stored node parameters without omitted defaults, which are restored during execution. An authenticated attacker with member privileges can save and run a workflow with omitted default parameters to send an unauthorized credential's decrypted value to a destination they control.


Remediation

Install update from vendor's website.

References