Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Release: n8n-io n8n 1.123.80, 2.39.6, 2.40.1 Clear all filters
TI-2026-65632 CVE-2026-103257 · GHSA-cfpw-gmwr-v9wc

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

Priority LOW 38

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers.

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00427 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-22
TI-2026-65630 CVE-2026-103255 · GHSA-34g6-xwv9-46f3

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

Priority LOW 33

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validat…

CVSS 4.0HIGH 7.1 Network No auth No interaction EPSS 0.00296 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-73
TI-2026-65629 CVE-2026-103254 · GHSA-w2h3-gf8c-fwgw

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

Priority LOW 31

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals.

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.0028 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-22
TI-2026-65627 CVE-2026-103252 · GHSA-r56q-6p4g-65g7

n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

Priority LOW 31

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validatin…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00273 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-639
TI-2026-65626 CVE-2026-103251 · GHSA-c2h5-4pr8-j687

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

Priority LOW 34

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments.

CVSS 4.0HIGH 7.5 Adjacent network Low privileges No interaction EPSS 0.00201 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-862
TI-2026-65625 CVE-2026-103250 · GHSA-gpvq-4wmp-cp47

n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

Priority LOW 30

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00201 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-943
TI-2026-65624 CVE-2026-103249 · GHSA-7g6m-6jgv-fqm4

n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator

Priority LOW 30

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00212 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-79
TI-2026-65623 CVE-2026-103248 · GHSA-c6j4-7wv3-xqf9

n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

Priority LOW 33

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values.

CVSS 4.0HIGH 7.1 Network No auth No interaction EPSS 0.00301 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-89
TI-2026-65620 CVE-2026-103245 · GHSA-f4rh-5hw6-wc66

n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

Priority LOW 36

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00157 Published 2026-10-01 Fixed in 1.123.80, 2.39.6 +1 CWE-347