n8n@1.123.67

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incorrect Authorization in the run_node_tool function in the agents module. An attacker can gain unauthorized access to credential secrets and execute arbitrary nodes by interacting with an agent that has node tools enabled, bypassing proper authorization checks.

Upgrade n8n to version 2.29.8, 2.31.0 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incorrect Authorization in the authentication when the embed login feature is enabled and at least one trusted key source is configured. An attacker can gain unauthorized access to any existing user account by presenting a validly-signed token with an unverified email claim from a trusted issuer.

Note: This is only exploitable if the embed login feature is enabled and at least one trusted key source is configured.

Upgrade n8n to version 2.31.5, 2.32.1 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incorrect Authorization in the process that handles credential domain restrictions when user-supplied base or endpoint URLs are set. An attacker can exfiltrate credential secrets by configuring affected nodes to send secrets to an attacker-controlled host.

Note: This is only exploitable if a credential has domain restrictions configured and is shared with non-owner users.

Upgrade n8n to version 2.31.5, 2.32.1 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incorrect Authorization in the Token Exchange process. An attacker can gain elevated privileges and execute arbitrary code by obtaining a valid external JWT accepted by a configured trusted key, which allows invoking administrator-only Public API operations such as role escalation, user creation, and user deletion.

Note: This is only exploitable if both the Token Exchange feature and the Public API are enabled, and the attacker can obtain an external JWT trusted by a configured issuer. Role escalation additionally requires an Advanced Permissions license; Community Package installation additionally requires both N8N_COMMUNITY_PACKAGES_ENABLED=true and N8N_UNVERIFIED_PACKAGES_ENABLED=true.

Upgrade n8n to version 2.29.8, 2.30.1 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Improper Restriction of Communication Channel to Intended Endpoints via the AI Agents MCP verifier in packages/cli/src/modules/agents/builder/agents-builder-tools.service.ts. An attacker can send the agent to an arbitrary MCP server URL and cause a shared credential’s secret to be sent to a server they control by running an AI Agent with a member-shared credential that has domain restrictions. This affects deployments with the AI Agents module enabled and credentials shared with member-level users. The vulnerable MCP request path did not enforce the credential’s allowed-domain restriction, so the agent could make outbound requests that exposed the credential outside the intended set of domains.

Notes

• The advisory’s affected deployments are narrower than “AI Agents enabled” alone: it only applies when N8N_ENABLED_MODULES=agents is set and a credential with an Allowed HTTP Request Domains restriction has been shared to a member-level user.
• The credential exfiltration path is through the AI Agents MCP connector’s verifier, so the issue sits in the outbound MCP tool-check flow rather than general agent execution or other credential-sharing paths.

Workarounds

• Disable the AI Agents module by removing agents from N8N_ENABLED_MODULES; this prevents member users from using the MCP connector path that can send a shared credential secret to an arbitrary server.
• Restrict credential sharing to fully trusted users only; this limits exposure of domain-restricted credentials to users who could misuse the MCP tool to exfiltrate secrets.
• Audit credentials with domain restrictions for unexpected sharing relationships; this helps identify and remove shares that could allow the bypass to be exercised.

Upgrade n8n to version 2.27.4, 2.28.1 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to User Impersonation via the token-exchange identity-resolution service in packages/cli/src/modules/token-exchange/services/identity-resolution.service.ts. An attacker can authenticate as another user by presenting a valid token from one trusted issuer whose JWT sub matches a victim account created under a different trusted issuer. The token-exchange flow resolves local identities using the subject claim alone instead of pairing it with the issuer, so instances that trust more than one external issuer can map two different upstream accounts to the same local account. This lets the attacker access the victim’s n8n account and its data and actions with the victim’s permissions.

Notes

• The issue only applies when token exchange is enabled, and an instance trusts more than one external issuer; a single trusted issuer does not create the cross-issuer account-collision condition described in the advisory.
• The collision is between identities stored under the token-exchange provider mapping, so the vulnerable path is the external-identity binding used during exchange rather than general n8n login or local user authentication.

Workarounds

• If multiple trusted issuers are not required, reduce the token exchange configuration to a single trusted issuer to prevent cross-issuer subject collisions from binding two external accounts to the same local account.
• Disable the token exchange feature entirely if it is not in active use to block the token-exchange authentication path that can be abused for account misbinding.

Upgrade n8n to version 2.27.4, 2.28.1 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) n the credential management flow, where the Authorization URL field of an OAuth2 credential accepts a javascript: URL that is not sanitized before being wired to the OAuth authorization button. A user with permission to create and share credentials can execute arbitrary JavaScript in another user's browser session by embedding such a URL in a shared OAuth2 credential, which runs when the victim opens the credential and activates the authorization button. Exploitation requires the attacker to hold credential creation and sharing permissions and the victim to open the shared credential and interact with the authorization button.

Upgrade n8n to version 2.6.4, 2.8.0 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incorrect Authorization in the Public API execution retry endpoint, which authorizes the request against the workflow:read permission instead of workflow:execute. A user with only workflow:read access to a shared workflow can run workflow retries they are not permitted to execute by calling the Public API retry endpoint. Exploitation requires the workflow to be shared with the user or across projects, and the retry runs the workflow, which can read data or change state within that workflow's scope.

Upgrade n8n to version 2.25.7, 2.26.2 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incorrect Authorization in workflow creation folder assignment, which does not verify that the requested target folder belongs to a project the requester is allowed to access. A user with workflow creation permission in one project can associate a newly created workflow with a folder belonging to a different project they cannot access by submitting a crafted creation request. Exploitation requires multi-project and folder support to be enabled, and the impact is confined to a logical integrity violation of the target project's folder structure at the database level, since the workflow stays in the requester's project, remains invisible to the target project, and exposes no target project data.

Upgrade n8n to version 2.28.0 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs for the Python Code node when the Python Task Runner is enabled. A user with permission to create or modify workflows can evade the validator and reach the task executor module namespace by authoring Python in that node, and on instances configured with N8N_BLOCK_RUNNER_ENV_ACCESS=false can read environment variables available to the task runner process. Exploitation is limited to self-hosted instances with the Python Task Runner enabled, and the environment variable disclosure applies only when N8N_BLOCK_RUNNER_ENV_ACCESS=false.

Upgrade n8n to version 2.25.7, 2.26.2 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the MCP OAuth client registration process. An attacker can exhaust server memory resources and render the instance unavailable by sending large unauthenticated registration payloads to the endpoint, which accepts requests regardless of MCP access settings.

A fix was pushed into the master branch but not yet published.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Source Control feature when configured to use SSH, as the SSH command disables host key verification. An attacker can intercept repository data or inject malicious content by performing a man-in-the-middle attack between the affected instance and the remote Git server.

Upgrade n8n to version 2.5.0 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Incorrect Authorization in the OAuth callback when the N8N_SKIP_AUTH_ON_OAUTH_CALLBACK environment variable is set to true. An attacker can gain unauthorized access to OAuth tokens by tricking a victim into completing an OAuth flow against a credential object controlled by the attacker, allowing the attacker to execute workflows as the victim.

Upgrade n8n to version 2.6.4, 2.7.3 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Credential Management Flow when a crafted OAuth2 credential contains a JavaScript URL in the Authorization URL field. An attacker can execute arbitrary scripts in the victim's browser session by convincing an authenticated user with permission to create and share credentials to interact with the OAuth authorization button.

Upgrade n8n to version 2.6.4, 2.8.0 or higher.

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Improper Authentication via the Self-Service Settings API. An attacker can circumvent centralized identity management and multi-factor authentication by disabling SSO enforcement for their own account and creating local credentials after authenticating through SSO.

Upgrade n8n to version 2.8.0 or higher.