These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-92588 debrief: The n8n workflow automation platform has a vulnerability in its source control push endpoint, allowing cross-project data destruction. This medium-severity issue affects n8n versions before 1.123.76, 2.37.7, and 2.38.2. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. n8n users with this featur [truncated]
CVE-2026-92587 is a vulnerability in the n8n workflow automation platform that allows an authenticated user to access and merge objects from a Git repository outside the configured sandbox. The issue arises from the Git node's validation of relative remote URLs against the repository path, which can be exploited by nesting the repository one level below the configured path. This vulnerability has been fix [truncated]
CVE-2026-86085 is a vulnerability in the n8n workflow automation platform that allows unauthorized access to member names and email addresses. The issue was fixed in versions 2.37.7 and 2.38.2. Affected deployments should be verified and patched to prevent unauthorized access. The vulnerability has a medium severity and defenders should assess exposure and apply patches accordingly. The affected controlle [truncated]
A vulnerability in n8n, a workflow automation platform, allows for disruption of later requests due to improper handling of workflow summaries. The issue is fixed in versions 2.37.7 and 2.38.2. This vulnerability impacts n8n instances that use versions prior to 2.37.7 or 2.38.2. The summarizeWorkflowStructure function improperly handles workflow summaries, allowing for disruption of later requests. The CV [truncated]
CVE-2026-86077 is a vulnerability in the n8n workflow automation platform that allows an anonymous form submitter to reuse a resume token on the chat route to release certain approval gates. The issue is fixed in versions 2.37.7 and 2.38.2. This vulnerability impacts n8n instances that have not been patched, allowing potential exploitation. Defenders should assess exposure and apply patches to prevent pot [truncated]
CVE-2026-86076 is a high-severity vulnerability in the n8n workflow automation platform. Affected versions allow for backend code execution and editor-preview JavaScript execution due to improper sanitization of user-supplied input. The issue is caused by the expression compiler sanitizer resolving through dynamically scoped 'this' and not rejecting reserved class member names. A class field named __sanit [truncated]
CVE-2026-86075 is a vulnerability in the n8n workflow automation platform that allows an unauthenticated remote caller to persist oversized values in oauth_clients and exhaust database storage. The issue is fixed in versions 2.37.7 and 2.38.2. This vulnerability impacts n8n instances with exposed or internet-facing deployments. Defenders should assess exposure and prioritize updating to fixed versions to [truncated]
CVE-2026-86074 is a vulnerability in the n8n workflow automation platform that allows for potential security risks due to improper validation of credential test or verification URLs. This issue, fixed in versions 2.37.7 and 2.38.2, could lead to security consequences if exploited. The vulnerability impacts n8n instances prior to these versions, allowing attackers to potentially manipulate URLs, leading to [truncated]
CVE-2026-86073 debrief based on the supplied source corpus. The CVE record was published on 2026-09-08T17:18:39.167Z. n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. This oversight allows an OAuth client approved for one workflow to potenti [truncated]
A server-side request forgery vulnerability exists in n8n versions before 2.34.1 due to a validation logic flaw in the legacy request helper function exposed to Code and Function nodes. This flaw allows attackers to bypass validation by supplying a safe 'uri' alongside a malicious 'url' to access internal addresses. The vulnerability can lead to unauthorized internal network access and potential data brea [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:40.110Z and has not been modified since then. The n8n server is vulnerable to SSRF protection bypass via the SearXNG Agent tool. Instances with N8N_SSRF_PROTECTION_ENABLED=true are affected. An authenticated user could set the API URL to an internal host, causing the n8n server to connect t [truncated]
The Git node in n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1 contains a code execution vulnerability. This vulnerability executes certain repository-local git configuration values without neutralizing them, allowing for code execution as the n8n process user. The vulnerability requires a separate file-write vulnerability to plant the malicious value. Users and administrators should be aware of this [truncated]
The CVE-2026-77083 vulnerability affects the n8n workflow automation platform in versions prior to 1.123.69, 2.33.4, and 2.34.1. An authenticated user can exploit a sandbox escape via Function.prototype pollution in the JavaScript Code node. This requires specific modules to be allowlisted in the deployment configuration for a full exploit chain. The vulnerability has a medium severity and was published o [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:39.717Z and has not been modified since then. The n8n workflow automation tool contains a regular expression denial of service (ReDoS) vulnerability in its Filter and Switch nodes. These nodes compile user-supplied regex patterns using new RegExp() and execute them synchronously on the work [truncated]
The CVE-2026-77081 record describes an allowed-domains bypass vulnerability in the GraphQL node of n8n, a workflow automation tool. This vulnerability allows an authenticated user with workflow-authoring rights to send a domain-restricted credential to an attacker-controlled endpoint, potentially exfiltrating it with the leaked credential's permissions. The CVE record was published on 2026-08-20T12:16:39. [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:39.430Z and has not been modified since then. The n8n workflow automation tool contains an arbitrary file read and write vulnerability in the Snowflake node. The vulnerability occurs because the Snowflake node passes free-form Execute Query input, including client-side commands, directly to [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:39.263Z and has not been modified since then. The n8n workflow automation tool contains an authorization bypass vulnerability in its custom project role deletion (reassignment) path. A user with only the manageProject global scope can delete any custom project role and reassign its holders, [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:39.127Z and has not been modified since then. The n8n workflow automation tool contains a JavaScript task runner VM sandbox escape vulnerability in versions before 1.123.69, 2.33.4, and 2.34.1. An authenticated user with Code node access can exploit prototype pollution to execute arbitrary [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:38.997Z and has not been modified since then. The n8n workflow automation tool has an information disclosure vulnerability in its GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error without modification. This error can cont [truncated]
The n8n workflow automation tool contains an expression injection vulnerability in the resource-locator field's link preview rendering. This vulnerability allows an authenticated user to store a malicious value, which is then evaluated as JavaScript in the victim's authenticated session when another user opens the affected node, enabling cross-user script execution. The CVE record was published on 2026-08 [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:38.487Z and has not been modified since then. The NVD entry is currently Received. The completion page of the Form node in n8n before versions 1.123.69, 2.33.4, and 2.34.1 applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was al [truncated]
The n8n workflow automation tool contains a PostgREST filter injection vulnerability in its Supabase node, affecting versions before 1.123.69, 2.33.4, and 2.34.1. An attacker could inject conditions that widen filters to match every row, leading to full-table disclosure, deletion, or modification. Organizations using n8n should prioritize patching to prevent potential impacts. This involves reviewing and [truncated]
The CVE-2026-77070 vulnerability is a NoSQL injection issue in n8n's MongoDB node operations, specifically in the Find, Delete, and Aggregate operations. The vulnerability occurs because the Query parameter is parsed as JSON after expression resolution without sanitizing MongoDB operators. This allows an attacker to inject operators such as $ne or $where, potentially leading to full-collection disclosure [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:38.097Z and has not been modified since then. This SSRF protection bypass in n8n's OAuth2 credential authorization-code-to-access-token exchange allows an attacker to potentially access internal systems or services. A user with credential-creation permissions can set the access-token URL to [truncated]
The CVE-2026-77068 vulnerability affects n8n versions before 2.33.4 and 2.34.x before 2.34.1. It is a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. This allows an authenticated user with global:member privileges to reference mal [truncated]
CVE-2026-71539 is a high-severity vulnerability in the n8n workflow automation platform that allows authenticated users to execute arbitrary code on the server by manipulating the Git node clone operation. This vulnerability can be exploited by swapping a validated directory for a symlink before cloning, potentially leading to arbitrary code execution on the server after a restart. Defenders responsible f [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T13:19:08.040Z and has not been modified since then. The CVE-2026-72775 SQL injection vulnerability exists in the PostgresTrigger node of n8n before 1.123.67, 2.31.5, and 2.32.1. Authenticated users can inject arbitrary SQL, potentially leading to full read and write access to the connected Postgr [truncated]
CVE-2026-72774 is a high-severity vulnerability in n8n, a workflow automation tool. An authenticated user with edit access to a shared workflow can bypass credential authorization in the HTTP Request node, potentially leading to unauthorized access to sensitive credentials. This CVE was published on 2026-08-11 and was last modified on 2026-09-18. The vulnerability exists in the HTTP Request node of n8n, a [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T13:19:07.757Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. The @n8n/computer-use file-search (search_files) tool in n8n before 2.31.5 and 2.32.x before 2.32.1 contains a path-confinement bypass vulnerability. A crafted search pattern can bypass the base-di [truncated]
CVE-2026-72772 is a high-severity vulnerability in n8n, a workflow automation tool, affecting versions before 2.32.1 and 2.31.5. The issue allows for account takeover through the Token Exchange Embed Login feature. An attacker can authenticate as any existing user if they obtain a token accepted by a configured trusted key, potentially leading to full account control.