n8n
- Software type
- Software application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/26/2026, n8n recorded 92 security vulnerabilities in the last 90 days, of which 53 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of n8n and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-110853n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSONCVE-2026-110852n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook ResolutionCVE-2026-110851n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create EndpointCVE-2026-110850n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node ParametersCVE-2026-110849n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-110853n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-110852n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-110851n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-110850n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-110849n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-110848n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-110847n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-110846n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-110845n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-110844n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
189 Results | Page 1 of 19