n8n has 104 CVEs on record between 2025 and 2026. Disclosures have slowed: 31 in the last 90 days after 67 in the 90 before. The busiest recent month was July 2026 with 44. The median CVSS is 6.5 (medium), with 4 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-863 (15) and CWE-79 (10). Most affected products: n8n (103), @n8n/computer-use (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —(1)
- Last 90 days
- 31 prev 67
Weakness classes
Products
- n8n 103
- @n8n/computer-use 1
Worst active — by depth score
CVE-2025-68613Critical· 9.9n8n is an open source workflow automation platform99CVE-2026-27577Critical· 9.9n8n is an open source workflow automation platform69CVE-2026-86076High· 8.8n8n is an open source workflow automation platform61CVE-2026-85168High· 8.8n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node61CVE-2025-65964High· 8.8n8n is an open source workflow automation platform61
n8n vulnerabilities
CVEs affecting n8n, newest first. Open any entry for full detail, references, and exploit status.
104 CVEsRSS
CVE-2026-72762High· 8.8n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user abl…
GHSA-9cmh-xcqm-5hqrMediumn8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
GHSA-jqwr-vx3p-r266Mediumn8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
GHSA-652q-gvq3-74qvMediumn8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
GHSA-fmvg-vhqq-r2mjMediumDuplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
GHSA-5vfw-jc4p-fj39MediumDuplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
GHSA-h9fm-xcv2-qfw3MediumDuplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
GHSA-4v35-78jc-648rMediumDuplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows
Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows
GHSA-88c4-pcqm-3r9pMediumDuplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
Duplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
GHSA-gf29-4f56-r2jfHighn8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
GHSA-vhf8-cg2h-cg3pMediumn8n: SSRF Protection Bypass via MCP Client Node
n8n: SSRF Protection Bypass via MCP Client Node
GHSA-rcv6-pvrj-4xcgHighn8n: Authenticated code execution in the n8n Git node
n8n: Authenticated code execution in the n8n Git node
GHSA-2x35-3fw4-9jr4Highn8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
GHSA-gv7g-jm28-cr3mHighn8n: Expression sandbox escape via arrow-function bodies enabling command execution
n8n: Expression sandbox escape via arrow-function bodies enabling command execution
GHSA-6qc9-mqvw-jg7xHighn8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
GHSA-cj9h-qx8g-pq2gHighn8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
GHSA-xmc9-4f2h-jf9cHighn8n: Edit Image Node Format Injection Allows Arbitrary File Write
n8n: Edit Image Node Format Injection Allows Arbitrary File Write
GHSA-xwx6-jjhv-84p8Highn8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
GHSA-hx4h-vr3m-45vhMediumn8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
GHSA-pf2q-pxhf-hgmwMediumn8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory
n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory
CVE-2026-59253Mediumn8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects
GHSA-m7jc-p4hf-xhwqHighDuplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
GHSA-wq64-hcrf-8m56HighDuplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
Duplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
GHSA-mwq7-vcmc-cm4qHighDuplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
GHSA-38fj-36m5-783cMediumDuplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
CVE-2026-59209Highn8n: Shared Credential Header Leak via HTTP Request Pagination Expression
n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
CVE-2026-59206Highn8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
CVE-2026-59207Highn8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
CVE-2026-59208Highn8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
GHSA-8342-988q-86crHighn8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login