DeutschShown in its original language — a full translation is planned for a future version.
n8n: Mehrere Schwachstellen
view advisory published 2026-02-25
Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren, um einen SQL-Injection Angriff durchzuführen, und um einen Cross-Site Scripting Angriff durchzuführen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56353US | — | — | ||
n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 t… | ||||
| CVE-2026-56349US | — | — | ||
n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malic… | ||||
| CVE-2026-56360US | — | — | ||
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned P… | ||||
| CVE-2026-56350US | high7.7 | — | ||
n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password cr… | ||||
| CVE-2026-56357US | medium5.3 | — | ||
n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who… | ||||
| CVE-2026-27578US | medium5.4 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject… | ||||
| CVE-2026-27577US | critical9.9 | Exploit | ||
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and… | ||||
| CVE-2026-27498US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Wr… | ||||
| CVE-2026-27497US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could leverag… | ||||
| CVE-2026-27495US | critical9.9 | Exploit | ||
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could exploit… | ||||
| CVE-2026-27494US | critical9.9 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the… | ||||
| CVE-2026-27493US | critical9.0 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes tha… | ||||
02
references
External citations — patches, advisories, analysis.
- EUVD-2026-8761 vom 2026-02-25external
- n8n GitHub Security Advisory GHSA-2p9h-rqjw-gm92 vom 2026-02-25external
- n8n GitHub Security Advisory GHSA-38c7-23hj-2wgq vom 2026-02-25external
- n8n GitHub Security Advisory GHSA-75g8-rv7v-32f7 vom 2026-02-25external
- n8n GitHub Security Advisory GHSA-f3f2-mcxc-pwjx vom 2026-02-25external
- n8n GitHub Security Advisory GHSA-fvfv-ppw4-7h2w vom 2026-02-25external
- n8n GitHub Security Advisory GHSA-jh8h-6c9q-7gmw vom 2026-02-25external
- n8n GitHub Security Advisory GHSA-jjpj-p2wh-qf23 vom 2026-02-25external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan