DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
n8n: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-03-25
Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um erweiterte Privilegien, einschließlich Administratorrechte, zu erlangen, um beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Cross-Site- und Man-in-the-Middle-Angriffe durchzuführen.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-56354US | medium5.4 | — | ||
n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML d… | ||||
| CVE-2026-56359US | — | — | ||
n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credenti… | ||||
| CVE-2026-56356US | — | — | ||
n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are t… | ||||
| CVE-2026-33751US | medium4.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.27, 2.13.3, and 2.14.1, a flaw in the LDAP node's filter escape logic allowed LDAP metacharacters to pas… | ||||
| CVE-2026-33749US | critical9.0 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.27, 2.13.3, and 2.14.1, an authenticated user with permission to create or modify workflows could craft… | ||||
| CVE-2026-33724US | high7.4 | — | ||
n8n is an open source workflow automation platform. Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for git operations explic… | ||||
| CVE-2026-33722US | medium5.3OT erhöht | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret… | ||||
| CVE-2026-33720US | medium4.2OT erhöht | — | ||
n8n is an open source workflow automation platform. Prior to version 2.8.0, when the `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK` environment variable is set to `true`, the OAuth callback han… | ||||
| CVE-2026-33696US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify workflows could exploi… | ||||
| CVE-2026-33665US | high7.5 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.4.0 and 1.121.0, when LDAP authentication is enabled, n8n automatically linked an LDAP identity to an existi… | ||||
| CVE-2026-33663US | medium6.5 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with the `global:member` role could exploit chained author… | ||||
| CVE-2026-33660US | high8.8 | — | ||
n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use th… | ||||
| CVE-2026-27496US | medium6.5 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify workflows could use the… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- n8n GitHub Security Advisory GHSA-c545-x2rh-82fc vom 2026-03-25external
- GitHub Advisory Database vom 2026-03-25external
- n8n GitHub Security Advisory GHSA-364x-8g5j-x2pr vom 2026-03-25external
- n8n GitHub Security Advisory GHSA-3c7f-5hgj-h279 vom 2026-03-25external
- n8n GitHub Security Advisory GHSA-43v7-fp2v-68f6 vom 2026-03-25external
- n8n GitHub Security Advisory GHSA-58qr-rcgv-642v vom 2026-03-25external
- n8n GitHub Security Advisory GHSA-fxcw-h3qj-8m8p vom 2026-03-25external
- n8n GitHub Security Advisory GHSA-m63j-689w-3j35 vom 2026-03-25external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan