VulertSecurity VulertSecurity

Vulnerability Database · npm · n8n · Version

n8n 1.123.75

1.123.75 is affected by 46 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 2 High 13 Medium 31 Low 0 Unrated 0

All n8n versions & vulnerabilities → Source repository Search the database for this package →
Released 21 Aug 2026 Licence non-standard Also known from other sources 55 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

n8n 1.123.75 vulnerabilities

46 vulnerabilities cover n8n 1.123.75. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Critical Arbitrary Command Execution Vulnerability in n8n Package 9.9 critical 2.0.0 26 Dec 2025
CVE-2026-25115: n8n Python Sandbox Escape Vulnerability 9.4 critical 2.4.8 04 Feb 2026
Credential Exfiltration Vulnerability in n8n: Bypass of Allowed HTTP Request Domains 9.1 medium 2.20.0 19 May 2026
SQL Injection Vulnerability in n8n MySQL v1 Node - Moderate Risk 8.8 medium No fix published 08 Jul 2026
CVE-2026-86076: n8n Expression Sandbox Escape Leading to Code Execution 8.7 high 1.123.76 10 Sep 2026
CVE-2026-54312: n8n Microsoft SQL Node Prototype Pollution Vulnerability 8.5 high 2.24.0 16 Jun 2026
SQL Injection Vulnerability in n8n Package: MySQL, PostgreSQL, and Microsoft SQL Nodes 8.2 medium 2.4.0 26 Feb 2026
CVE-2026-86083: n8n Expression Sandbox Escape Vulnerability Leading to Code Execution 7.7 high 1.123.76 10 Sep 2026
CVE-2026-54313: n8n NoSQL Injection Vulnerability in MongoDB Node Find And Replace Operation 7.7 medium 2.24.0 16 Jun 2026
CVE-2026-54303: n8n Reflected XSS Vulnerability via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints 7.6 medium 2.24.0 16 Jun 2026
CVE-2026-86082: n8n Domain-Restriction Bypass via Unguarded Model-Search Endpoint 7.1 high 1.123.76 10 Sep 2026
CVE-2026-86081: n8n Regular Expression Denial of Service via Git Node Clone Path 7.1 high 1.123.76 10 Sep 2026
CVE-2025-68697: n8n Arbitrary File Read/Write Vulnerability in Legacy Code Node 7.1 high 2.0.0 26 Dec 2025
External Secrets Permission Bypass in n8n: A Security Concern 6.5 medium No fix published 15 Jul 2026
CVE-2026-21894: n8n Unauthenticated Forged Webhooks via Missing Stripe-Signature Verification 6.5 medium 2.2.2 07 Jan 2026
Arbitrary File Path Bypass in n8n: ExecuteWorkflow Node Vulnerability 6.4 medium 2.19.3 19 May 2026
CVE-2026-86080: n8n GitHub Trigger Vulnerability Leading to Signature Verification Fail-Open 6.3 medium 1.123.76 10 Sep 2026
CVE-2026-86079: n8n Path Injection Vulnerability in Elasticsearch and ElasticSecurity Nodes 6.3 medium 1.123.76 10 Sep 2026
CVE-2026-65014: n8n Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook 6.3 medium 2.27.4 22 Jul 2026
SSO Enforcement Bypass in n8n: A Security Concern 6.3 medium 2.8.0 26 Feb 2026
CVE-2026-86084: n8n OIDC SSO Endpoints Remain Active After Disablement 6.0 medium 1.123.76 10 Sep 2026
CVE-2026-86993: n8n Log Streaming Event Destinations Expose Generic-Auth Credentials 5.9 medium 1.123.76 10 Sep 2026
CVE-2026-54314: n8n Denial of Service via ZIP Decompression in Webhook Workflow 5.9 medium 2.24.0 16 Jun 2026
CVE-2026-33724: n8n Vulnerability Due to Insecure SSH Configuration in Source Control 5.4 medium 2.5.0 25 Mar 2026
CVE-2026-86995: n8n Git Node Configuration Bypass Vulnerability 5.3 medium 1.123.76 10 Sep 2026
CVE-2026-86994: n8n Cross-User Active Workflow ID and Lifecycle Event Disclosure Vulnerability 5.3 medium 1.123.76 10 Sep 2026
CVE-2026-59253: n8n Improper Authorization Allows Workflow Misassignment 5.3 medium 2.28.0 22 Jul 2026
IP Whitelist Bypass Vulnerability in n8n: Partial String Matching Flaw 5.3 medium 2.2.0 13 Jan 2026
Improper Authorization in n8n Allows Workflow Assignment Across Projects 5.0 medium No fix published 08 Jul 2026
CVE-2026-33720: n8n OAuth Callback Authorization Bypass Vulnerability 4.7 medium 2.8.0 25 Mar 2026
Disk Space Exhaustion Vulnerability in n8n Package 4.3 medium No fix published 10 Jul 2026
Guardrail Node Bypass Vulnerability in n8n 3.7 medium 2.10.0 26 Feb 2026
Exposed Google Service Account Private Key in n8n Package - Vulnerability Summary N/A medium No fix published 22 Jul 2026
DOM-Based XSS Vulnerability in n8n: Unsandboxed iframe srcdoc Issue N/A high No fix published 22 Jul 2026
Race Condition Vulnerability in n8n Git Clone Node Allows Remote Code Execution N/A high No fix published 22 Jul 2026
Sensitive Data Exposure in n8n: Custom Header Credential Values Leaked in Plaintext N/A medium No fix published 22 Jul 2026
Legacy Expression Evaluator Sanitizer Bypass in n8n Leads to Authenticated Code Execution N/A high No fix published 22 Jul 2026
Stored DOM XSS Vulnerability in n8n Package - GHSA-h5xr-fqvj-253p N/A high No fix published 22 Jul 2026
Unauthenticated Endpoint Vulnerability in n8n: Risk of Test Webhook Cancellation N/A medium No fix published 22 Jul 2026
Authenticated SSRF Vulnerability in n8n: Internal Network Access Risk N/A medium No fix published 22 Jul 2026
OAuth Authorization Bypass in n8n: Member-Level Users Can Execute Other Users' Workflows N/A medium No fix published 22 Jul 2026
Privilege Escalation and Code Execution Vulnerability in n8n N/A high No fix published 22 Jul 2026
Privilege Escalation Vulnerability in n8n: AI Agents Project Viewer Exploit N/A high No fix published 22 Jul 2026
Security Flaw in n8n: GraphQL Node Bypasses Allowed HTTP Request Domains Restriction N/A medium No fix published 22 Jul 2026
Privilege Escalation Vulnerability in n8n: SSO Instance-Role Provisioning N/A high No fix published 22 Jul 2026
Information Disclosure Vulnerability in n8n: External Secrets Accessible via Workflow Expressions N/A medium No fix published 15 Jul 2026

Looking for another version, or everything Vulert holds for n8n?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About n8n 1.123.75

Is n8n 1.123.75 vulnerable?

Yes. 46 vulnerabilities in the Vulert database cover n8n 1.123.75: 2 critical, 13 high, 31 medium and 0 low. Each entry above names the fixed version to move to.

Is 1.123.75 the latest release of n8n?

No. 1.123.75 was published 21 Aug 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor n8n for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the n8n version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.