n8n CVEs
23 vulnerabilities mapped to n8n’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-59259 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets
CVSS 6.5 mediumEPSS 0.44%
CVE-2026-59254 n8n - External Secrets Disclosure via Workflow Node Expressions
CVSS 6.3 mediumEPSS 0.36%
CVE-2026-56353 n8n - Authentication Bypass in Chat Trigger Node
CVSS 4.8 mediumEPSS 0.33%
CVE-2026-56352 n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter
CVSS 6.4 mediumEPSS 0.33%
CVE-2026-56349 n8n - Guardrail Node Bypass via Crafted Input
CVSS 6.3 mediumEPSS 0.47%
CVE-2026-58661 n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint
CVSS 4.3 mediumEPSS 0.39%
CVE-2026-56354 n8n - Cross-Site Scripting and Open Redirect in Form Node
CVSS 4.1 mediumEPSS 0.24%
CVE-2026-59253 n8n - Improper Authorization in Workflow Assignment to Folders
CVSS 5.0 mediumEPSS 0.28%
CVE-2026-56778 n8n - Authorization Bypass in Public API Execution Retry Endpoint
CVSS 6.4 mediumEPSS 0.30%
CVE-2026-56776 n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint
CVSS 7.4 highEPSS 0.28%
CVE-2026-56775 n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints
CVSS 5.4 mediumEPSS 0.30%
CVE-2026-56360 n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
CVSS 4.0 mediumEPSS 0.31%
CVE-2026-56359 n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL
CVSS 5.4 mediumEPSS 0.24%
CVE-2025-71380 n8n - Arbitrary Command Execution via Execute Command Node
CVSS 8.8 highEPSS 0.57%
CVE-2026-56777 n8n - AST Validator Bypass in Python Code Node
CVSS 5.0 mediumEPSS 0.33%
CVE-2026-56356 n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field
CVSS 5.4 mediumEPSS 0.25%
CVE-2026-56350 n8n - SSO Enforcement Bypass via API
CVSS 6.3 mediumEPSS 0.38%
CVE-2026-56358 n8n - Stored Cross-Site Scripting in Form Trigger Node
CVSS 5.4 mediumEPSS 0.24%
CVE-2026-56351 n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes
CVSS 8.2 highEPSS 0.37%
CVE-2025-68613 n8n Vulnerable to Remote Code Execution via Expression Injection
CVSS 10.0 criticalKEV added EPSS 99.0%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)