EUVD-2026-90651

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103257

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103257

The automation platform n8n is vulnerable to a path traversal vulnerability in versions prior to 1.123.80, 2.39.6, and 2.40.1. The root cause is a failure to validate resource identifiers within the n8n node. An attacker can craft malicious resource IDs to redirect API calls to unintended targets...

CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103255

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

EUVD-2026-90649

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103255

Versions of n8n prior to 1.123.80, and from 2.0.0 before 2.39.6 and from 2.40.0 before 2.40.1, are vulnerable to a path traversal and query injection flaw in the Supabase node . The root cause is the lack of validation when the tableId parameter is inserted into request paths. Attackers can explo...

CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

EUVD-2026-90648

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...

CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...

CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...

CVE-2026-103254

The software n8n is vulnerable to a path traversal vulnerability in its signed resume URL generation for Send-and-Wait approvals . Affected versions include those before 1.123.80 , 2.0.0 before 2.39.6 , and 2.40.0 before 2.40.1 . An attacker with workflow creation permissions can exploit unresolv...

CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses tomcat-embed-websocket-10.1.57.jar and logback-classic-1.5.35.jar which are vulnerable to CVE-2026-73180 and CVE-2026-19880. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-19880 DESCRIPTION:...

Security Bulletin: Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687.

Summary Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-15687 DESCRIPTION: A security issue was discovered in the Kubernetes Java client librar...

BIT-RABBITMQ-2026-67224 RabbitMQ: Admin path-traversal write via trace name

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...