9 matches found
CVE-2026-118642
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...
EUVD-2026-112373
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...
CVE-2026-118642
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...
PT-2026-129140
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...
n8n authorization issue vulnerability
Versions prior to n8n 1.123.85, 2.43.5, and 2.44.1 contain an authorization issue vulnerability stemming from authorization bypass. Certified members can exploit this by using inline sub-workflow nodes with non-boolean “disabled” values to access credentials they should not have. Attackers who kn...
CVE-2026-118642: n8n-io n8n: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated…
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...
CVE-2026-100858
The heym software, in versions prior to 0.0.109 , is vulnerable to a Server-Side Request Forgery (SSRF) in the Slack, Discord, and Crawler workflow nodes . The root cause is the use of an unguarded HTTP client that issues requests to URLs provided in user-created credentials (specifically webhook...
Authorization Bypass Through User-Controlled Key
Overview @n8n/instance-ai is an Instance AI is the agent runtime behind the AI assistant experience in n8n. It lets users ask for help with workflows, executions, credentials, nodes, and workflow building from inside an n8n instance. Affected versions of this package are vulnerable to Authorizati...