Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: n8n-io n8n, n8n 2.41.4, 2.42.1 Clear all filters
TI-2026-82168 CVE-2026-118679 · GHSA-r9rf-g62g-xq7v

Server-side request forgery in n8n Slack Trigger leaks Slack tokens

Priority LOW 30

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verificati…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00273 Published 2026-10-28 Fixed in 1.123.83, 2.42.1 +1 CWE-918
TI-2026-82167 CVE-2026-118678 · GHSA-4v4v-jr32-r382

Prototype pollution in n8n workflow history compaction causes denial of service

Priority LOW 31

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00293 Published 2026-10-28 Fixed in 2.41.4, 2.42.1 CWE-1321
TI-2026-82166 CVE-2026-118677 · GHSA-qmh8-47xc-q5c6

n8n Local Gateway deep link silently re-pairs to attacker instance

Priority LOW 26

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instanc…

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00165 Published 2026-10-28 Fixed in 2.42.1, 2.41.4 CWE-939