Alertas de Seguridad de la Información

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65598] n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone ope…

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, exec…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65591] n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member h…

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65595] n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exch…

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations s…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65596] n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restrict…

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a cr…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65015] n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature whe…

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65016] n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Ent…

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to gl…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

09/07/2026

[CVE-2026-59206] n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authe…

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fi…

nvdaltovulnerabilidad CVSS 7.1 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-59257] n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerabil…

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger …

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-56776] n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{wor…

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unin…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71380] The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host…

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

24/06/2026

[CVE-2026-56351] n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft …

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integr…

nvdaltovulnerabilidad CVSS 8.2 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54308] n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent36…

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.

nvdaltovulnerabilidad CVSS 7.2 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54304] n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authen…

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the o…

nvdaltovulnerabilidad CVSS 7.7 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-49465] n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authen…

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8N_RESTRICT_FILE_ACCESS_TO file sandbox. This allowed the contents of any loca…

nvdaltovulnerabilidad CVSS 7.7 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-49444] n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authen…

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.

nvdaltovulnerabilidad CVSS 8.5 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-45732] n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth…

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow and overwrite the stored token material for that credential with tokens bound t…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-44790] n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authen…

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54311] n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated use…

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow persist into subsequent Merge SQL…

nvdaltovulnerabilidad CVSS 7.7 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54312] n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with perm…

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rende…

nvdaltovulnerabilidad CVSS 8.5 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54313] n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with work…

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is f…

nvdaltovulnerabilidad CVSS 7.7 NVD