[UPDATE] [high] n8n: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in n8n to execute arbitrary code, bypass security measures, manipulate data, perform an SQL injection attack, and conduct a cross-site scripting attack.
CSIRTS triage
- What
- Multiple vulnerabilities allow an attacker to execute arbitrary code, bypass security measures, manipulate data, and perform SQL injection and cross-site scripting attacks.
- Who is affected
- Deployments of n8n are affected.
- Urgency
- Remediation is high urgency due to the severity of the vulnerabilities and potential for exploitation.
- Action
- Update to the latest version of n8n to address these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch n8n
Get an email when a new n8n advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0532
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-563500.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-563600.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-274931.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-274940.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-274950.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-274970.77% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-274980.72% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-2757710.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 95% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-275780.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-563570.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-56350 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-56360 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27493 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27494 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27495 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27497 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27498 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27577 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27578 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-56357 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownNCSC-2026-0248 [1.00] [M/H] Vulnerabilities fixed in n8n workflow automation platformncsc-nl
- mediumCVE-2026-56360: n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webho…nvd
- mediumCVE-2026-56350: n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO us…nvd
Recent advisories for n8n
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] n8n: Multiple Vulnerabilitiescert-bund · 2026-08-21
- unknownn8n security advisory (AV26-836)cccs · 2026-08-20
- unknownCVE-2026-77085: n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG A…nvd · 2026-08-20
- unknownCVE-2026-77084: n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability i…nvd · 2026-08-20
- unknownCVE-2026-77083: n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the …nvd · 2026-08-20
- unknownCVE-2026-77082: n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression…nvd · 2026-08-20
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
- medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
- medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25