NCSC-2026-0228 [1.00] [M/H] Vulnerabilities fixed in n8n workflow automation platform

unknownCVE-2026-59253 CVE-2026-59257 CVE-2026-59206 CVE-2026-59207 CVE-2026-59208 CVE-2026-59209

n8n has fixed multiple vulnerabilities in the n8n workflow automation platform. The vulnerabilities include: - An authorization issue where authenticated users can assign workflows to folders within projects they do not have access to, due to insufficient validation of request payloads during workflow creation. - A SQL injection in the legacy MySQL v1 node executeQuery operation due to unparameterized expression substitution, allowing the execution of arbitrary SQL statements. - Furthermore, authenticated users with the workflow:create permission can cause Object.prototype pollution via specially crafted workflows, leading to unauthorized access to privileged endpoints. - Another vulnerability involves bypassing HTTP request domain restrictions in the AI Agents functionality by users with member-level permissions, which may result in exposure of shared credential secrets to external servers. - There is also an issue with improper validation of multiple trusted token-exchange issuers, allowing impersonation of users across different token issuers. - Finally, users with editor access can exfiltrate sensitive credential data via HTTP Request node pagination expressions. These vulnerabilities are present in various versions of n8n and relate to authorization, authentication, data integrity, and confidentiality within the platform.

CSIRTS triage

vendor: n8n product: n8n Authentication bypass SQL injectionOther

What: There are multiple vulnerabilities including authorization issues and SQL injection.
Who is affected: Authenticated users of the n8n workflow automation platform are affected.
Urgency: Remediation is urgent due to the potential for unauthorized access and data manipulation.
Action: Update to the latest version of n8n to mitigate these vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch n8n

Get an email when a new n8n advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-07-13
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0228

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-592530.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Low exploitation riskCVE-2026-592570.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all scored CVEs.
Low exploitation riskCVE-2026-592060.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
Low exploitation riskCVE-2026-592070.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all scored CVEs.
Low exploitation riskCVE-2026-592080.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all scored CVEs.
Low exploitation riskCVE-2026-592090.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59253	coverage & exploitation status	NVD · CVE.org
CVE-2026-59257	coverage & exploitation status	NVD · CVE.org
CVE-2026-59206	coverage & exploitation status	NVD · CVE.org
CVE-2026-59207	coverage & exploitation status	NVD · CVE.org
CVE-2026-59208	coverage & exploitation status	NVD · CVE.org
CVE-2026-59209	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for n8n workflow automation

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownNCSC-2026-0248 [1.00] [M/H] Vulnerabilities fixed in n8n workflow automation platformncsc-nl · 2026-07-17
mediumCVE-2026-59209: n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an…nvd · 2026-07-09
mediumCVE-2026-59208: n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2…nvd · 2026-07-09
mediumCVE-2026-59207: n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents …nvd · 2026-07-09
highCVE-2026-59206: n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an…nvd · 2026-07-09
unknownNCSC-2026-0212 [1.00] [M/H] Vulnerabilities fixed in n8n workflow automation platformncsc-nl · 2026-06-29