DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
n8n: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-04-22
Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, SQL-Injection-Angriffe durchzuführen, einen Denial-of-Service-Zustand verursachen, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder Sitzungen zu kapern.
01
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-42237US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy M… | ||||
| CVE-2026-42236US | high7.5 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests and… | ||||
| CVE-2026-42235US | critical9.6 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a c… | ||||
| CVE-2026-42234US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a… | ||||
| CVE-2026-42233US | critical9.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allowed user-controlled in… | ||||
| CVE-2026-42232US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achiev… | ||||
| CVE-2026-42231US | high8.8 | Exploit | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook h… | ||||
| CVE-2026-42230US | medium6.1 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth client registrations without aut… | ||||
| CVE-2026-42229US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-con… | ||||
| CVE-2026-42228US | medium6.5OT erhöht | Exploit | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature… | ||||
| CVE-2026-42227US | medium6.5 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with a valid API key scoped to variable:list could read va… | ||||
| CVE-2026-42226US | high7.5OT erhöht | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authenticated caller was… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-44v6-jhgm-p3m4 vom 2026-04-22external
- GitHub Security Advisory GHSA-49m9-pgww-9vq6 vom 2026-04-22external
- GitHub Security Advisory GHSA-537j-gqpc-p7fq vom 2026-04-22external
- GitHub Security Advisory GHSA-756q-gq9h-fp22 vom 2026-04-22external
- GitHub Security Advisory GHSA-f6x8-65q6-j9m9 vom 2026-04-22external
- GitHub Security Advisory GHSA-f77h-j2v7-g6mw vom 2026-04-22external
- GitHub Security Advisory GHSA-hp3c-vfpm-q4f7 vom 2026-04-22external
- GitHub Security Advisory GHSA-hqr4-h3xv-9m3r vom 2026-04-22external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan