n8n vulnerabilities

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.

The setWebhookResolver in the application (likely n8n) lacks validation of user-supplied URLs. An authenticated user can make the server send repeated requests to internal endpoints, including link-local metadata addresses. The response is not returned via the API, making the attack blind.

The scanFeedsResolver in the application (likely n8n) lacks URL validation, allowing an authenticated user to direct the server to arbitrary internal endpoints. The response is parsed as an RSS/Atom feed or HTML, limiting disclosure to feed metadata and RSS/Atom links, but allows distinguishing reachable ports from unreachable ones.

In n8n, an open source workflow automation platform, prior to versions 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server.

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.

Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 allows credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted.

n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.

Vulnerability in n8n before versions 2.31.5 and 2.32.1 allows account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key could authenticate as any existing user and gain full account control.

Vulnerability in n8n before version 2.32.1 fails to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-privileged workflow editors with use-only access to shared credentials can redirect requests to attacker-controlled hosts and exfiltrate credential secrets for reuse against underlying services.

Vulnerability in n8n before version 1.123.67 contains a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at local paths outside the sandbox to pull arbitrary git repositories and read their files and history.

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process (a sandbox escape), leading to a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected.

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection, exposing internal services and reading responses back through the workflow.

Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 allows remote code execution in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.

Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 contains a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected.

Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential's ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow's project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.

Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 allows arbitrary file write in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders.

Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.

n8n versions before 1.123.64, 2.29.8, and 2.30.1 have a credential exposure vulnerability. When configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field. Since JWT headers are Base64-encoded, the private key could be recovered by anyone logging or inspecting the JWT.

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

n8n before versions 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a controlled server and exfiltrate restricted credentials. Affects instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owners.

In n8n before versions 2.30.1 and 2.29.8, all Public API key scopes are assigned to JWTs issued through the Token Exchange module regardless of the user's role. A low-privileged user with a valid external JWT can obtain an access token allowing administrator-only operations, including role escalation, user creation, and deletion, and, if unverified Community Package installation is enabled, remote code execution.

n8n before versions 2.29.8 and 2.30.1 (since 2.27.0) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow runs in the owner's context with the owner's credentials.

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

In n8n before version 1.123.64, custom HTTP header credentials in LLM sub-node execution data are not properly masked, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read these credentials.

Privilege escalation vulnerability in n8n before versions 1.123.64, 2.29.8, and 2.30.1 in Enterprise SSO. An attacker can obtain the global:owner role, gaining full administrative control.

In n8n before version 2.30.1, the AI Agents feature has an authorization flaw that allows a Project Viewer user to escalate privileges by chatting with an agent that has node tools enabled, enabling execution of arbitrary nodes and access to credential secrets.

In n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch), the DELETE /${restEndpoint}/test-webhook/:id endpoint is registered before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

A permission bypass vulnerability in n8n before versions 1.123.61, 2.27.4, and 2.28.1 affects external secrets handling. An authenticated user with credential create or update permissions but without the externalSecret:list scope can embed external secret references into credentials that static validation does not detect; these references resolve at workflow execution time, exposing secret values.

In n8n before version 2.28.1, an information disclosure vulnerability exists where external secrets are incorrectly resolved in workflow node expressions outside the credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0, the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials.

A vulnerability in n8n before version 2.19.3 allows bypassing file access restrictions in the legacy ExecuteWorkflow node. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to check for file existence on the host and, if the file is a valid workflow JSON, load and execute it.

In n8n before version 2.10.0, an input validation vulnerability in the Guardrail node allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

A vulnerability in n8n before version 2.28.0 (and before 1.123.58 on the 1.x branch) allows disk space exhaustion via the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, enabling an authenticated user to repeatedly upload files that accumulate on disk until periodic cleanup runs.

In n8n before versions 1.123.24, 2.10.4, and 2.12.0, cross-site scripting and open redirect vulnerabilities were found in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies.

In n8n prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node and exfiltrate the secret through item data.

In n8n prior to versions 2.27.4 and 2.28.1, when configured with more than one trusted token-exchange issuer, external identities were resolved to local accounts using only the JWT sub claim, ignoring the iss claim. This allowed an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim.

In n8n prior to versions 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL. This allowed a member-level user with use-only access to a shared credential to send its secret to an external server they control.

In n8n, an open source workflow automation platform, prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. This allowed unauthenticated requests to be treated as a privileged user and exposed user and project listing endpoints.

A SQL injection vulnerability in n8n before versions 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 exists in the legacy MySQL v1 node's executeQuery operation. Evaluated {{ ... }} expression values are substituted directly into the raw SQL string without parameterization, allowing an attacker to inject arbitrary SQL through input reaching these expressions when the workflow is connected to an externally reachable trigger (e.g., Webhook).

In n8n before version 2.28.0, an improper authorization vulnerability allows authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.

An authorization bypass vulnerability in n8n before 2.25.7 and 2.26.x before 2.26.2 allows authenticated users with read-only access to a shared workflow to retry its executions via the Public API, using the workflow:read scope instead of workflow:execute.

A vulnerability in n8n before versions 1.123.55, 2.25.7, and 2.26.2 allows authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. It uses the workflow:read scope instead of workflow:execute, enabling an authenticated user with read-only access to trigger a real test run of the workflow.

A vulnerability in n8n before versions 1.123.55, 2.25.7, and 2.26.2 involves incorrect authorization in three mutating evaluation test-run endpoints. These endpoints use the workflow:read scope instead of the appropriate workflow:execute scope for state-changing actions.

A vulnerability in n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

A cross-site scripting vulnerability exists in n8n before version 2.8.0 within the credential management flow. Authenticated users can inject malicious JavaScript URLs into the OAuth2 credential Authorization URL field. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in the victim's browser with their privileges.