# n8n CVEs > n8n: 23 CVEs mapped to its software or packages (1 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/n8n/cves Last updated: 2026-07-15T11:25:35Z 23 CVEs map to n8n (1 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [n8n](https://rewindex.com/company/n8n.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that n8n’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-07-15 | [CVE-2026-59259](https://rewindex.com/cve/CVE-2026-59259.md) | n8n - Permission Bypass via Expression Parser Mismatch in External Secrets | 6.5 medium | | | 2026-07-15 | [CVE-2026-59254](https://rewindex.com/cve/CVE-2026-59254.md) | n8n - External Secrets Disclosure via Workflow Node Expressions | 6.3 medium | | | 2026-07-15 | [CVE-2026-56353](https://rewindex.com/cve/CVE-2026-56353.md) | n8n - Authentication Bypass in Chat Trigger Node | 4.8 medium | | | 2026-07-15 | [CVE-2026-56352](https://rewindex.com/cve/CVE-2026-56352.md) | n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter | 6.4 medium | | | 2026-07-15 | [CVE-2026-56349](https://rewindex.com/cve/CVE-2026-56349.md) | n8n - Guardrail Node Bypass via Crafted Input | 6.3 medium | | | 2026-07-10 | [CVE-2026-58661](https://rewindex.com/cve/CVE-2026-58661.md) | n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint | 4.3 medium | | | 2026-07-10 | [CVE-2026-56354](https://rewindex.com/cve/CVE-2026-56354.md) | n8n - Cross-Site Scripting and Open Redirect in Form Node | 4.1 medium | | | 2026-07-08 | [CVE-2026-59257](https://rewindex.com/cve/CVE-2026-59257.md) | n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation | 8.8 high | | | 2026-07-08 | [CVE-2026-59253](https://rewindex.com/cve/CVE-2026-59253.md) | n8n - Improper Authorization in Workflow Assignment to Folders | 5.0 medium | | | 2026-07-08 | [CVE-2026-56778](https://rewindex.com/cve/CVE-2026-56778.md) | n8n - Authorization Bypass in Public API Execution Retry Endpoint | 6.4 medium | | | 2026-07-08 | [CVE-2026-56776](https://rewindex.com/cve/CVE-2026-56776.md) | n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint | 7.4 high | | | 2026-07-08 | [CVE-2026-56775](https://rewindex.com/cve/CVE-2026-56775.md) | n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints | 5.4 medium | | | 2026-07-08 | [CVE-2026-56360](https://rewindex.com/cve/CVE-2026-56360.md) | n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger | 4.0 medium | | | 2026-07-08 | [CVE-2026-56359](https://rewindex.com/cve/CVE-2026-56359.md) | n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL | 5.4 medium | | | 2026-07-04 | [CVE-2025-71380](https://rewindex.com/cve/CVE-2025-71380.md) | n8n - Arbitrary Command Execution via Execute Command Node | 8.8 high | | | 2026-06-30 | [CVE-2026-56777](https://rewindex.com/cve/CVE-2026-56777.md) | n8n - AST Validator Bypass in Python Code Node | 5.0 medium | | | 2026-06-30 | [CVE-2026-56356](https://rewindex.com/cve/CVE-2026-56356.md) | n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field | 5.4 medium | | | 2026-06-30 | [CVE-2026-56350](https://rewindex.com/cve/CVE-2026-56350.md) | n8n - SSO Enforcement Bypass via API | 6.3 medium | | | 2026-06-24 | [CVE-2026-56358](https://rewindex.com/cve/CVE-2026-56358.md) | n8n - Stored Cross-Site Scripting in Form Trigger Node | 5.4 medium | | | 2026-06-24 | [CVE-2026-56351](https://rewindex.com/cve/CVE-2026-56351.md) | n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes | 8.2 high | | | 2026-06-22 | [CVE-2026-56357](https://rewindex.com/cve/CVE-2026-56357.md) | n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger | 4.0 medium | | | 2026-06-22 | [CVE-2026-56348](https://rewindex.com/cve/CVE-2026-56348.md) | n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint | 9.1 critical | | | 2025-12-19 | [CVE-2025-68613](https://rewindex.com/cve/CVE-2025-68613.md) | n8n Vulnerable to Remote Code Execution via Expression Injection | 10.0 critical | yes (2026-03-11) | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (n8n) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 1 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 1 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 1 | 1 | 2 | 0 | 0 | 0 | | 2026-06-29 | 0 | 1 | 3 | 0 | 0 | 0 | | 2026-07-06 | 0 | 2 | 7 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 5 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/n8n/cves · Markdown: https://rewindex.com/company/n8n/cves.md · JSON: https://rewindex.com/api/v1/companies/n8n/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:06:20.520Z