DeutschShown in its original language — a full translation is planned for a future version.
n8n: Mehrere Schwachstellen
view advisory published 2026-08-19
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery-Angriffe (SSRF) durchzuführen, Informationen offenzulegen und Daten zu manipulieren.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-85173US | medium4.3 | — | ||
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workf… | ||||
| CVE-2026-85172US | medium6.4 | — | ||
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks… | ||||
| CVE-2026-85171US | medium6.5 | — | ||
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to t… | ||||
| CVE-2026-85170US | medium6.5 | — | ||
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated user… | ||||
| CVE-2026-85169US | high8.8 | — | ||
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring… | ||||
| CVE-2026-85168US | high8.8 | Exploit | ||
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys be… | ||||
| CVE-2026-85167US | medium6.5 | — | ||
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which… | ||||
| CVE-2026-85166US | medium6.5OT elevated | — | ||
n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool… | ||||
| CVE-2026-85165US | critical9.9 | — | ||
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve agai… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-4r56-g65c-fm83 vom 2026-08-19external
- GitHub Security Advisory GHSA-95ph-833c-4wrp vom 2026-08-19external
- GitHub Security Advisory GHSA-9x83-43r8-5hwc vom 2026-08-19external
- GitHub Security Advisory GHSA-fg85-4wv2-p98j vom 2026-08-19external
- GitHub Security Advisory GHSA-jmmj-93rg-6j39 vom 2026-08-19external
- GitHub Security Advisory GHSA-jp9j-jr97-w9pj vom 2026-08-19external
- GitHub Security Advisory GHSA-mwp5-2m32-r54h vom 2026-08-19external
- GitHub Security Advisory GHSA-vrv8-j27g-g7cr vom 2026-08-19external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan