n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

CVE-2026-65596

## Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (suc

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

CVE-2026-65594

## Impact The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated

历史摘要 · 未重新核验 · GitHub Advisory

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

CVE-2026-65590

## Impact The shell tool in the `@n8n/computer-use` package applied its sandbox restrictions only on macOS. On Linux and

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

CVE-2026-58661

## Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

CVE-2026-59253

## Impact An authenticated user with permission to create workflows in one project could bypass project/folder authoriza

历史摘要 · 未重新核验 · GitHub Advisory

n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

CVE-2026-59254

## Impact External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be ava

历史摘要 · 未重新核验 · GitHub Advisory

n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

CVE-2026-59257

## Impact The legacy MySQL v1 node's `executeQuery` operation substitutes evaluated `{{ ... }}` expression values direct

历史摘要 · 未重新核验 · GitHub Advisory

n8n: External Secrets Permission Bypass via Expression Parser Mismatch

CVE-2026-59259

## Impact Due to a mismatch between the static validation check and the runtime expression engine, an authenticated user

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

## Impact The component `@n8n/computer-use` file-search tool confined searches to a configured base directory. A crafte

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

## Impact An authenticated user able to create or edit a workflow expression could abuse the expression engine's array-

历史摘要 · 未重新核验 · GitHub Advisory

n8n: SSRF Protection Bypass via MCP Client Node

## Impact On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoin

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

CVE-2026-65593

## Impact Endpoints in `/rest/dynamic-node-parameters/` lacked authorization scopes, making it reachable by any authent

历史摘要 · 未重新核验 · GitHub Advisory

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

CVE-2026-59921

# Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder ## 1. Vulnerabil

历史摘要 · 未重新核验 · GitHub Advisory

Netty: STOMP CONNECT Frame Header Injection in Netty

CVE-2026-59920

# Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty ## 1. Vulnerability Summary | Field | V

历史摘要 · 未重新核验 · GitHub Advisory

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

CVE-2026-59919

# Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty ## 1. Vulnerability Su

历史摘要 · 未重新核验 · GitHub Advisory

Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

CVE-2026-59900

Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails

历史摘要 · 未重新核验 · GitHub Advisory

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

CVE-2026-59899

### Impact `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-chann

历史摘要 · 未重新核验 · GitHub Advisory

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

CVE-2026-59898

## Summary An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Security Control Bypass via CORS Short-Circuit Failure

CVE-2026-56746

### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin r

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via...

CVE-2026-63143

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122

历史摘要 · 未重新核验 · GitHub Advisory