CVE-2026-103257

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103257

The automation platform n8n is vulnerable to a path traversal vulnerability in versions prior to 1.123.80, 2.39.6, and 2.40.1. The root cause is a failure to validate resource identifiers within the n8n node. An attacker can craft malicious resource IDs to redirect API calls to unintended targets...

CVE-2026-103247

Versions of n8n before 1.123.80 are vulnerable to a credential tampering flaw caused by duplicate node IDs . Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to bypass the workflow credential tamper guard. This allows the attacker to retain victim ...

CVE-2026-103247 n8n before 1.123.80 Credential Tampering via Duplicate Node IDs

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to...

bugbounty-arsenal-resources

BugBounty Arsenal Resources Curated workflows, tools and references for bug bounty hunters and web security researchers. What is BugBounty Arsenal? BugBounty Arsenal is a practical web testing platform focused on recon workflows, endpoint discovery and security testing utilities. The goal is to...

CVE-2026-103247: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to...

CVE-2026-103257: Improper Limitation of a Pathname to a Restricted Directory

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-71899

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-71897

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

EUVD-2026-88816

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-71899

Apache DolphinScheduler versions 3.2.0 before 3.4.3 are susceptible to a missing authorization vulnerability in the query-dynamic-sub-workflows API. The root cause is that the API fails to verify if an authenticated user possesses the necessary permissions to access the specific workflows being q...

CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

BIT-ARGO-WORKFLOWS-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CLEANSTART-2026-ZQ97544 path-to-regexp turns path strings into a regular expressions

Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...

CLEANSTART-2026-NW68824 Impact: In body-parser versions prior to 1

Security vulnerability affects the argo-workflows package. Impact: In body-parser versions prior to 1...

CLEANSTART-2026-XS33213 shell-quote prior to 1

Security vulnerability affects the argo-workflows package. shell-quote prior to 1...

CLEANSTART-2026-WO79894 websocket-driver is a WebSocket protocol handler with pluggable I/O

Security vulnerability affects the argo-workflows package. websocket-driver is a WebSocket protocol handler with pluggable I/O...

CLEANSTART-2026-HE25090 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the argo-workflows package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-RQ08724 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

Security vulnerability affects the argo-workflows package. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects...