DeutschShown in its original language — a full translation is planned for a future version.
n8n: Mehrere Schwachstellen
view advisory published 2026-07-22
Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
01
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-72774US | medium6.5OT elevated | — | ||
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can refer… | ||||
| CVE-2026-72773US | high7.7 | — | ||
n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-… | ||||
| CVE-2026-72772US | high8.8OT elevated | — | ||
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local acco… | ||||
| CVE-2026-72771US | medium6.5OT elevated | — | ||
n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-priv… | ||||
| CVE-2026-72770US | medium6.5 | — | ||
n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-pat… | ||||
| CVE-2026-72769US | high8.1 | — | ||
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression… | ||||
| CVE-2026-72768US | high8.3 | — | ||
n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections.… | ||||
| CVE-2026-72767US | high8.8 | — | ||
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execut… | ||||
| CVE-2026-72766US | high7.5 | — | ||
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are s… | ||||
| CVE-2026-72765US | critical9.9 | — | ||
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft e… | ||||
| CVE-2026-72764US | high8.8 | — | ||
n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a C… | ||||
| CVE-2026-72763US | medium6.5OT elevated | — | ||
n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's… | ||||
| CVE-2026-72762US | high8.8 | — | ||
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying im… | ||||
| CVE-2026-72750US | high8.8 | — | ||
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into t… | ||||
| CVE-2026-72749US | medium6.5 | — | ||
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter wi… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-2x35-3fw4-9jr4 vom 2026-07-22external
- GitHub Security Advisory GHSA-64xh-79j6-r5v8 vom 2026-07-22external
- GitHub Security Advisory GHSA-652q-gvq3-74qv vom 2026-07-22external
- GitHub Security Advisory GHSA-6qc9-mqvw-jg7x vom 2026-07-22external
- GitHub Security Advisory GHSA-8342-988q-86cr vom 2026-07-22external
- GitHub Security Advisory GHSA-9cmh-xcqm-5hqr vom 2026-07-22external
- GitHub Security Advisory GHSA-cj9h-qx8g-pq2g vom 2026-07-22external
- GitHub Security Advisory GHSA-gf29-4f56-r2jf vom 2026-07-22external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan