N8n
Vulnerability activity for N8n: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- –UnscoredOct 29, 2026N8nADV-cccs-e000e5ee85c9Serial number: AV26-1103 Date: October 29, 2026 As of October 28, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 2.44.1 Prior to 2.43.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Crafted Workflow ID Gives Access to Data Tables in Other Projects Overview - n8n-io/n8n
- –UnscoredOct 15, 2026N8nADV-cccs-8aef0c5dc3eeSerial number: AV26-1044 Date: October 15, 2026 As of October 14, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 1.123.83 Prior to 2.41.4 Prior to 2.42.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SQL Injection in the Microsoft SQL Node via Expression Interpolation into the Query Field Advisory Shared-Workflow Credential Check Misses Nested and Tool Inline Sub-Wor
- 4.3MediumJul 10, 2026n8n Denial of serviceCVE-2026-58661n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
- 10.0CriticalMar 11, 2026n8nCVE-2025-68613n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.Exploited99% likelyExploit codeMetasploit · NucleiDetection
Top products
- n8n2 CVEs in the last year, 1 critical, 1 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 29, 2026n8n security advisory (AV26-1103)ADV-cccs-e000e5ee85c9
- CCCS (Canada) · Oct 15, 2026n8n security advisory (AV26-1044)ADV-cccs-8aef0c5dc3ee
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.