{"kind": "product", "path": "vulns/npm/n8n", "name": "n8n", "product": "n8n", "ecosystem": "npm", "items": [{"id": "CVE-2026-86075", "noindex": false, "published": "2026-09-08T21:29:38.596Z", "modified": "2026-09-09T16:03:52.236Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00609, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86075", "title": "n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint", "description": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-hh89-3r9w-qj3j", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"], "fixes": ["2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86076", "noindex": false, "published": "2026-09-08T21:28:52.762Z", "modified": "2026-09-09T15:33:55.770Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N", "severity": "high", "epss": 0.00793, "kev": false, "exploits": ["github-poc", "public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86076", "title": "n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-hw8v-xxg5-vvvx", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86077", "noindex": false, "published": "2026-09-08T21:28:06.303Z", "modified": "2026-09-14T12:05:05.655Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86077", "title": "n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket", "description": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-35jj-42hp-8gmq", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"], "fixes": ["2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86078", "noindex": false, "published": "2026-09-08T21:27:21.351Z", "modified": "2026-09-09T16:03:58.476Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00586, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86078", "title": "n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service", "description": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"], "fixes": ["2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86079", "noindex": false, "published": "2026-09-08T21:26:28.296Z", "modified": "2026-09-09T15:13:30.345Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "medium", "epss": 0.00491, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86079", "title": "n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cp-m7mv-8jpv", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86080", "noindex": false, "published": "2026-09-08T21:25:48.009Z", "modified": "2026-09-09T13:16:31.787Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00259, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86080", "title": "n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-5m98-cgcr-xx3q", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86081", "noindex": false, "published": "2026-09-08T21:24:20.936Z", "modified": "2026-09-09T13:45:42.273Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0056, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86081", "title": "n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-j535-v25q-vx3q", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86082", "noindex": false, "published": "2026-09-08T21:23:23.606Z", "modified": "2026-09-14T12:03:25.112Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "high", "epss": 0.00415, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86082", "title": "n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-34ff-336r-5q23", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86083", "noindex": false, "published": "2026-09-08T21:22:40.687Z", "modified": "2026-09-09T13:24:59.627Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00664, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86083", "title": "n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.3", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-6xcw-7xm6-48c6", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86084", "noindex": false, "published": "2026-09-08T21:21:55.410Z", "modified": "2026-09-09T13:50:25.691Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86084", "title": "n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86085", "noindex": false, "published": "2026-09-08T21:20:35.653Z", "modified": "2026-09-14T12:02:18.643Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00444, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86085", "title": "n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints", "description": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses. The affected controller is packages/cli/src/controllers/role.controller.ts, which omitted the project:list scope check. This issue is fixed in versions 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-cqr2-h44g-v75v", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"], "fixes": ["2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86993", "noindex": false, "published": "2026-09-08T21:19:53.255Z", "modified": "2026-09-09T16:04:06.689Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.00459, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86993", "title": "n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint. The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-pq6c-vh67-xpm3", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86994", "noindex": false, "published": "2026-09-08T21:18:43.912Z", "modified": "2026-09-09T15:40:12.574Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.00342, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86994", "title": "n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-65xw-2v52-jhxc", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86995", "noindex": false, "published": "2026-09-08T21:17:38.773Z", "modified": "2026-09-09T13:34:48.379Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.00405, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86995", "title": "n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read", "description": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-qgpw-8g46-w95v", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"], "fixes": ["1.123.76", "2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86996", "noindex": false, "published": "2026-09-08T21:15:38.432Z", "modified": "2026-09-09T13:52:43.147Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00294, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86996", "title": "n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy", "description": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-7hgx-277f-7vmg", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"], "fixes": ["2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86074", "noindex": false, "published": "2026-09-08T17:38:11.915Z", "modified": "2026-09-09T16:04:32.580Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00376, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86074", "title": "n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content", "description": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2f", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"], "fixes": ["2.37.7", "2.38.2"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-86073", "noindex": false, "published": "2026-09-08T17:01:24.441Z", "modified": "2026-09-09T15:58:40.814Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0039, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86073", "title": "n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution", "description": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-cw9w-vv67-hf73", "https://github.com/n8n-io/n8n/pull/37122", "https://github.com/n8n-io/n8n/pull/37588"], "fixes": ["2.37.7", "2.38.1"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-72775", "noindex": false, "published": "2026-08-11T12:17:13.395Z", "modified": "2026-08-11T17:50:19.590Z", "cvss": 5.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "severity": "medium", "epss": 0.00471, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-72775", "title": "n8n before 1.123.67 SQL Injection via PostgresTrigger Node", "description": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266", "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node", "https://nvd.nist.gov/vuln/detail/CVE-2026-72775"], "fixes": ["1.123.67", "2.31.5", "2.32.1"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-72774", "noindex": false, "published": "2026-08-11T12:17:12.713Z", "modified": "2026-08-11T14:02:07.820Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00438, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-72774", "title": "n8n before 1.123.67 Authentication Bypass via HTTP Request Node", "description": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-6qc9-mqvw-jg7x", "https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-http-request-node", "https://nvd.nist.gov/vuln/detail/CVE-2026-72774"], "fixes": ["1.123.67", "2.31.5", "2.32.1"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}, {"id": "CVE-2026-72773", "noindex": false, "published": "2026-08-11T12:17:12.012Z", "modified": "2026-08-11T18:03:58.423Z", "cvss": 4.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "medium", "epss": 0.00568, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-72773", "title": "n8n before 2.32.1 Path Traversal via computer-use search_files", "description": "n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.", "references": ["https://github.com/n8n-io/n8n/security/advisories/GHSA-pf2q-pxhf-hgmw", "https://www.vulncheck.com/advisories/n8n-before-path-traversal-via-computer-use-search-files", "https://nvd.nist.gov/vuln/detail/CVE-2026-72773"], "fixes": ["2.31.5", "2.32.1"], "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}, {"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}]}], "total": 156, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 8, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "n8n", "path": "vulns/npm/n8n", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["2.38.1", "2.32.1", "2.31.5", "2.30.1", "2.29.8", "2.28.1", "2.28.0", "2.27.4", "2.26.2", "2.26.1", "2.25.7", "2.24.0"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-14T12:05:05.655Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}