If you discover a (suspected) security vulnerability, please report it through our Vulnerability Disclosure Program.
Repository navigation
Security: n8n-io/n8n
Security
SECURITY.md
-
SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) NodeGHSA-2x68-96jw-5r6c published
Oct 28, 2026 by MatsuuuModerate -
Deprecated Code Nodes Allow Code Execution in the n8n Main ProcessGHSA-9p7v-45m2-wxgj published
Oct 28, 2026 by MatsuuuHigh -
Asana Trigger: Unauthenticated Request Can Reset Webhook Verification SecretGHSA-mx4r-96jx-v278 published
Oct 28, 2026 by MatsuuuModerate -
MongoDB Node Update Operations Can Modify Unintended DocumentsGHSA-4v22-g448-h4rg published
Oct 28, 2026 by MatsuuuModerate -
Insecure GraphicsMagick ConfigurationGHSA-f2cw-9483-7vcp published
Oct 28, 2026 by MatsuuuHigh -
OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated CallbackGHSA-426f-xmcv-g8pg published
Oct 28, 2026 by MatsuuuModerate -
Open Redirect via MCP OAuth Dynamic Client RegistrationGHSA-rc3w-8jc8-7x3w published
Oct 28, 2026 by MatsuuuModerate -
Browser Use Upload Tool Reads Arbitrary Files from the n8n ServerGHSA-9qx8-fhxv-w794 published
Oct 28, 2026 by MatsuuuModerate -
Credential-Using Nodes Forward Authentication Headers on Cross-Origin RedirectsGHSA-prmc-fg87-r4gh published
Oct 28, 2026 by MatsuuuModerate -
Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All RequestsGHSA-pwj5-wwm6-g83j published
Oct 28, 2026 by MatsuuuModerate
Learn more about advisories related to n8n-io/n8n in the GitHub Advisory Database