🚨 CVE-2026-103245
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
🎖@cveNotify
GitHub
Missing Webhook Signature Verification in Webflow Trigger Node Allows Forged Event Injection
## Impact
The Webflow Trigger node accepted any HTTP POST to its webhook URL without verifying the `x-webflow-signature` HMAC that Webflow attaches to webhook deliveries. An unauthenticated atta...
The Webflow Trigger node accepted any HTTP POST to its webhook URL without verifying the `x-webflow-signature` HMAC that Webflow attaches to webhook deliveries. An unauthenticated atta...
🚨 CVE-2026-103246
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.
🎖@cveNotify
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.
🎖@cveNotify
GitHub
Inline Agent Node-Tool Introspection Decrypts Any Instance Credential Without Ownership Check
## Impact
Registering a node tool on an inline agent resolved the tool's input schema before the language model was consulted, and that resolution decrypted and used whatever credential the ca...
Registering a node tool on an inline agent resolved the tool's input schema before the language model was consulted, and that resolution decrypted and used whatever credential the ca...
🚨 CVE-2026-103247
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.
🎖@cveNotify
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.
🎖@cveNotify
GitHub
Duplicate Node IDs Bypass Workflow Credential Tamper Guard, Exposing Credentials to a Shared Workflow Editor
## Impact
Workflows shared with an editor keep credential-bearing nodes read-only, reverting on save any node that references a credential the editor cannot access. The revert matched nodes by id ...
Workflows shared with an editor keep credential-bearing nodes read-only, reverting on save any node that references a credential the editor cannot access. The revert matched nodes by id ...
🚨 CVE-2026-103248
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
🎖@cveNotify
GitHub
Supabase Node Filters (String) Mode Allows PostgREST Filter Injection
## Impact
The Supabase node's "Filters (String)" mode inserted its field into the query sent to the database with no escaping, and the field accepts expressions. Where a workflow bui...
The Supabase node's "Filters (String)" mode inserted its field into the query sent to the database with no escaping, and the field accepts expressions. Where a workflow bui...
🚨 CVE-2026-103249
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
🎖@cveNotify
GitHub
Stored DOM XSS via Resource Locator Dropdown Link Handling
## Impact
A Resource Locator parameter stores a URL that its dropdown offers as an external link, and that URL was opened without checking its scheme. A workflow author could set it to a script UR...
A Resource Locator parameter stores a URL that its dropdown offers as an external link, and that URL was opened without checking its scheme. A workflow author could set it to a script UR...
🚨 CVE-2026-103250
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.
🎖@cveNotify
GitHub
NoSQL Injection in MongoDB Chat Memory Node Allows Unauthenticated Cross-Session Chat History Disclosure
## Impact
The MongoDB Chat Memory node accepted the sessionId value from the Chat Trigger request body without validating that it was a plain string before passing it to the MongoDB query that loa...
The MongoDB Chat Memory node accepted the sessionId value from the Chat Trigger request body without validating that it was a plain string before passing it to the MongoDB query that loa...
🚨 CVE-2026-103251
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.
🎖@cveNotify
GitHub
Community Package Install Validation Bypass via PubSub in Queue Mode Deployments
## Impact
In deployments using Redis for scaling (queue mode), the internal handler that installs a community package applied none of the checks the normal install path performs — name and prefix ...
In deployments using Redis for scaling (queue mode), the internal handler that installs a community package applied none of the checks the normal install path performs — name and prefix ...
🚨 CVE-2026-103252
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
🎖@cveNotify
GitHub
Credential Test Endpoint Resolves Project-Scoped Variables from Attacker-Controlled Project ID
## Impact
The endpoint that tests a credential took the project used to resolve workflow variables from the request body, with no check that the caller may access that project. Because expressions...
The endpoint that tests a credential took the project used to resolve workflow variables from the request body, with no check that the caller may access that project. Because expressions...
🚨 CVE-2026-103253
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
🎖@cveNotify
GitHub
SQL Injection in Oracle Database Node Delete Table Drop Operation
## Impact
The Oracle Database node's Delete Table → Drop operation inserts the table and schema values into a dynamically built PL/SQL statement without neutralising single quotes, so a quote ...
The Oracle Database node's Delete Table → Drop operation inserts the table and schema values into a dynamically built PL/SQL statement without neutralising single quotes, so a quote ...
🚨 CVE-2026-103254
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.
🎖@cveNotify
GitHub
Path Traversal in Signed Resume URL Generation Enables Cross-Project Approval Forgery
## Impact
The signed resume URL for a Send-and-Wait approval interpolated a caller-controlled node ID, and traversal sequences in it were resolved before signing. The signature covered only the pa...
The signed resume URL for a Send-and-Wait approval interpolated a caller-controlled node ID, and traversal sequences in it were resolved before signing. The signature covered only the pa...
🚨 CVE-2026-103255
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.
🎖@cveNotify
GitHub
Path Traversal and Query Injection via the Supabase Node Table Name
## Impact
The Supabase node inserted the tableId parameter into the request path without validation, and the parameter accepts expressions, so it could be bound to untrusted input. A traversal seq...
The Supabase node inserted the tableId parameter into the request path without validation, and the parameter accepts expressions, so it could be bound to untrusted input. A traversal seq...
🚨 CVE-2026-103256
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.
🎖@cveNotify
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.
🎖@cveNotify
GitHub
Wekan and Baserow Credentials Leak Account Password to Unvalidated Host via preAuthentication Hook
## Impact
The Wekan and Baserow username-and-password credentials send the account username and password, unencrypted, to a URL taken from the credential's own host field, on a path the "...
The Wekan and Baserow username-and-password credentials send the account username and password, unencrypted, to a URL taken from the credential's own host field, on a path the "...
🚨 CVE-2026-103257
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
🎖@cveNotify
GitHub
Path Traversal in the n8n Node Redirects Public API Calls to Unintended Resources
## Impact
The built-in n8n node built its Public API request paths from a caller-supplied resource id without encoding or validating it, so a crafted id could redirect the call to a different reso...
The built-in n8n node built its Public API request paths from a caller-supplied resource id without encoding or validating it, so a crafted id could redirect the call to a different reso...
🚨 CVE-2026-103258
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.
🎖@cveNotify
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.
🎖@cveNotify
GitHub
Unescaped Parameter Interpolation into Third-Party Query Languages Enables Filter Bypass and Bulk Data Disclosure
## Impact
The SendGrid, Freshservice, and ServiceNow nodes constructed third-party query or filter strings by directly interpolating bindable node parameters into DSL literals without neutralising...
The SendGrid, Freshservice, and ServiceNow nodes constructed third-party query or filter strings by directly interpolating bindable node parameters into DSL literals without neutralising...
🚨 CVE-2026-103259
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access.
🎖@cveNotify
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access.
🎖@cveNotify
GitHub
Dynamic Credentials Authorize Endpoint Leaks Session Token to Attacker-Controlled Resolver
## Impact
The Dynamic Credentials authorize and revoke endpoints forwarded the caller's raw session token to the configured resolver, missing the check the execution path already applied. Sinc...
The Dynamic Credentials authorize and revoke endpoints forwarded the caller's raw session token to the configured resolver, missing the check the execution path already applied. Sinc...
🚨 CVE-2026-103260
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.
🎖@cveNotify
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.
🎖@cveNotify
GitHub
Approval Bypass in the Send and Wait Node's Approve Within Chat Mode
## Impact
The approval gate in the Send and Wait node's "Approve Within Chat" mode could be bypassed: a resume request could be accepted without the verification that it came from Sl...
The approval gate in the Send and Wait node's "Approve Within Chat" mode could be bypassed: a resume request could be accepted without the verification that it came from Sl...
🚨 CVE-2026-103262
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
🎖@cveNotify
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
🎖@cveNotify
GitHub
Bound the memory an HTTP client response can consume · tornadoweb/tornado@e412435
Backport for 6.5.9. On master this is ten commits; the net change is the
same, minus two things that do not exist on this branch: master's rejection
of a coroutine streaming_callback (here ...
same, minus two things that do not exist on this branch: master's rejection
of a coroutine streaming_callback (here ...
🚨 CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
🎖@cveNotify
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
🎖@cveNotify
GitHub
web: Do not follow symlinks out of the static directory · tornadoweb/tornado@437ab5f
StaticFileHandler.validate_absolute_path checked the requested path
against the configured root using os.path.abspath, which does not
resolve symlinks. A symlink inside the static directory could t...
against the configured root using os.path.abspath, which does not
resolve symlinks. A symlink inside the static directory could t...
🚨 CVE-2026-103264
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
🎖@cveNotify
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
🎖@cveNotify
GitHub
Unauthenticated iOS/iPadOS device API access via non-secret host identifiers
### Summary
Fleet's device API (`/api/v1/fleet/device/{token}/...`) supports a URL-based authentication fallback for iOS/iPadOS hosts, used by the self-service WebClip, which carries the dev...
Fleet's device API (`/api/v1/fleet/device/{token}/...`) supports a URL-based authentication fallback for iOS/iPadOS hosts, used by the self-service WebClip, which carries the dev...
🚨 CVE-2026-103265
Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.
🎖@cveNotify
Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.
🎖@cveNotify
GitHub
Team-scoped users can read MDM command results for hosts on other teams via shared command UUID
### Summary
The MDM command results endpoint (`GET /api/latest/fleet/commands/results`, and its deprecated alias `GET /api/latest/fleet/mdm/commandresults`), when called without the optional `host...
The MDM command results endpoint (`GET /api/latest/fleet/commands/results`, and its deprecated alias `GET /api/latest/fleet/mdm/commandresults`), when called without the optional `host...
🚨 CVE-2026-103266
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the recipient's email client, the injected content may be rendered, resulting in HTML injection or cross-site scripting (XSS).
🎖@cveNotify
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the recipient's email client, the injected content may be rendered, resulting in HTML injection or cross-site scripting (XSS).
🎖@cveNotify
GitHub
Unauthenticated Stripe Checkout Allowed Member Account Modification and HTML Injection in Newsletters
### Impact
A malicious actor could attach a paid subscription to an existing member, modify their name, and inject content into newsletters sent to the member. Depending on the email client, mal...
A malicious actor could attach a paid subscription to an existing member, modify their name, and inject content into newsletters sent to the member. Depending on the email client, mal...