n8n vulnerabilities

Recent CVEs affecting n8n products. 17 tracked.

n8n has 17 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-08-20. Highest priority: CVE-2026-72765 (score 49/100).

• CVE-2026-77079 HIGH 8.8 UPGRADE n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignmen
• CVE-2026-72765 CRITICAL 9.9 UPGRADE n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation
• CVE-2026-72764 HIGH 8.8 UPGRADE n8n's JavaScript task runner shared a single module cache across all users' Code-node executions
• CVE-2026-72767 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability
• CVE-2026-72750 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute
• CVE-2026-72762 HIGH 8.8 UPGRADE n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Ima
• CVE-2026-72766 HIGH 7.5 UPGRADE n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the
• CVE-2026-72775 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, wh
• CVE-2026-72772 HIGH 8.8 UPGRADE n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login fea
• CVE-2026-72769 HIGH 8.1 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engi
• CVE-2026-72773 HIGH 7.7 UPGRADE n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-sea
• CVE-2026-72768 HIGH 8.3 UPGRADE n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Cl
• CVE-2026-72770 MEDIUM 6.5 UPGRADE n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-ta
• CVE-2026-72749 MEDIUM 6.5 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set)
• CVE-2026-72774 MEDIUM 6.5 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node
• CVE-2026-72763 MEDIUM 6.5 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials an
• CVE-2026-72771 MEDIUM 6.5 UPGRADE n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM n

FAQ

How do I fix n8n vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is n8n being exploited right now?

None of the tracked n8n CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which n8n CVE should I patch first?

CVE-2026-72765 currently ranks highest (49/100): n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation.

Products

• n8n

← Back to latest CVEs