n8n vulnerabilities

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

In n8n before version 1.123.64, custom HTTP header credentials in LLM sub-node execution data are not properly masked, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read these credentials.

Privilege escalation vulnerability in n8n before versions 1.123.64, 2.29.8, and 2.30.1 in Enterprise SSO. An attacker can obtain the global:owner role, gaining full administrative control.

In n8n before version 2.30.1, the AI Agents feature has an authorization flaw that allows a Project Viewer user to escalate privileges by chatting with an agent that has node tools enabled, enabling execution of arbitrary nodes and access to credential secrets.

In n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch), the DELETE /${restEndpoint}/test-webhook/:id endpoint is registered before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

A permission bypass vulnerability in n8n before versions 1.123.61, 2.27.4, and 2.28.1 affects external secrets handling. An authenticated user with credential create or update permissions but without the externalSecret:list scope can embed external secret references into credentials that static validation does not detect; these references resolve at workflow execution time, exposing secret values.

In n8n before version 2.28.1, an information disclosure vulnerability exists where external secrets are incorrectly resolved in workflow node expressions outside the credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0, the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials.

A vulnerability in n8n before version 2.19.3 allows bypassing file access restrictions in the legacy ExecuteWorkflow node. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to check for file existence on the host and, if the file is a valid workflow JSON, load and execute it.

In n8n before version 2.10.0, an input validation vulnerability in the Guardrail node allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

A vulnerability in n8n before version 2.28.0 (and before 1.123.58 on the 1.x branch) allows disk space exhaustion via the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, enabling an authenticated user to repeatedly upload files that accumulate on disk until periodic cleanup runs.

In n8n before versions 1.123.24, 2.10.4, and 2.12.0, cross-site scripting and open redirect vulnerabilities were found in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies.

In n8n prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node and exfiltrate the secret through item data.

In n8n prior to versions 2.27.4 and 2.28.1, when configured with more than one trusted token-exchange issuer, external identities were resolved to local accounts using only the JWT sub claim, ignoring the iss claim. This allowed an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim.

In n8n prior to versions 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL. This allowed a member-level user with use-only access to a shared credential to send its secret to an external server they control.

In n8n, an open source workflow automation platform, prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. This allowed unauthenticated requests to be treated as a privileged user and exposed user and project listing endpoints.

A SQL injection vulnerability in n8n before versions 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 exists in the legacy MySQL v1 node's executeQuery operation. Evaluated {{ ... }} expression values are substituted directly into the raw SQL string without parameterization, allowing an attacker to inject arbitrary SQL through input reaching these expressions when the workflow is connected to an externally reachable trigger (e.g., Webhook).

In n8n before version 2.28.0, an improper authorization vulnerability allows authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.

An authorization bypass vulnerability in n8n before 2.25.7 and 2.26.x before 2.26.2 allows authenticated users with read-only access to a shared workflow to retry its executions via the Public API, using the workflow:read scope instead of workflow:execute.

A vulnerability in n8n before versions 1.123.55, 2.25.7, and 2.26.2 allows authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. It uses the workflow:read scope instead of workflow:execute, enabling an authenticated user with read-only access to trigger a real test run of the workflow.

A vulnerability in n8n before versions 1.123.55, 2.25.7, and 2.26.2 involves incorrect authorization in three mutating evaluation test-run endpoints. These endpoints use the workflow:read scope instead of the appropriate workflow:execute scope for state-changing actions.

A vulnerability in n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

A cross-site scripting vulnerability exists in n8n before version 2.8.0 within the credential management flow. Authenticated users can inject malicious JavaScript URLs into the OAuth2 credential Authorization URL field. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in the victim's browser with their privileges.

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

A vulnerability in n8n before version 2.25.7 and 2.26.x before 2.26.2 allows bypassing the AST security validator in the Python Code node. An authenticated user with permission to create or modify workflows containing this node can access the task executor module namespace.

n8n contains a stored XSS vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.

An authentication bypass vulnerability in n8n before version 2.8.0 allows authenticated SSO users to disable SSO enforcement via the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

n8n is an open source workflow automation platform. Prior to version 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation, leading to unintended documents being matched and overwritten with attacker-controlled content.

n8n is a workflow automation platform that prior to version 2.24.0 allowed authenticated users with permissions to create or modify workflows to achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter.