n8n
- Software type
- Software application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/28/2026, n8n recorded 92 security vulnerabilities in the last 90 days, of which 53 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of n8n and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-110843n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize EndpointCVE-2026-110842n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation InterpreterCVE-2026-110841n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool ApprovalCVE-2026-110840n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query FieldCVE-2026-103260n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-110843n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-110842n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-110841n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-110840n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-103260n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-103259n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-103258n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-103257n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-103256n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-103255n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
189 Results | Page 2 of 19