EUVD-2026-101728

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an...

EUVD-2026-101733

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...

EUVD-2026-101723

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

@1mcp/agent (>=0.38.0, <=0.39.0-beta.3), @3ngram/server (>=1.1.0, <=1.8.5) +303 more potentially affected by unknown CVE via @modelcontextprotocol/node (>=2.0.0-beta.1, <=2.0.0)

@modelcontextprotocol/node NPM version =2.0.0-beta.1, =0.38.0, =1.1.0, =0.2.0, =0.1.6, =12.0.0, =0.3.0, =0.59.0, =0.1.0, =0.2.1, =0.1.0, =1.0.0, =0.2.2, =0.24.0, =0.13.1-beta.0, =0.19.4-beta.1 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0146...

CVE-2026-111344: Authorization Bypass Through User-Controlled Key

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/nodeId/description, which skips space membership and node permission check...

PT-2026-122741

Security vulnerability affects the opentelemetry-collector-contrib package. Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node...

PT-2026-122689

Security vulnerability affects the renovate package. node-tar is a full-featured Tar for Node...

PT-2026-115288

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/nodeId/description, which skips space membership and node permission check...

CVE-2026-110850

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...

CVE-2026-110845

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an...

CVE-2026-110840

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-110850 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...

CVE-2026-110850 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...

CVE-2026-110850

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...

CVE-2026-110850

The n8n workflow automation tool is vulnerable in versions before 2.41.4 and 2.42.0 before 2.42.1 due to a Credential Check Bypass . The root cause is that the system fails to validate credential IDs stored within agent node parameters when an editor saves a shared workflow, as the security check...

CVE-2026-110850 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...

CVE-2026-110845 n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an...

CVE-2026-110845 n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an...

CVE-2026-110845

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an...

CVE-2026-110845

The automation platform n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 is vulnerable to code execution within the Git node Log operation . The root cause is the failure to strip a repository's local git configuration before invoking an external program. Authenticated me...