Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-59208

  CVE-2026-59208: n8n Cross-Issuer JWT Token Exchange Account Takeover

  n8n's Enterprise token-exchange login matched incoming JWTs to user accounts using only the JWT subject claim, ignoring which issuer signed the token, letting an attacker with a valid token from one…

• highCVE-2026-65016

  CVE-2026-65016: n8n SSO Instance-Role Provisioning Privilege Escalation to Owner

  When n8n's Enterprise SSO role provisioning is enabled, an attacker who can control the instance-role claim sent by the Identity Provider can set it to the owner role, gaining full administrative…

• high

  n8n Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

  Authenticated n8n users can point a Git remote at an arbitrary local path and use the fetch, pull, or pushTags operations to read files and history from outside the intended sandbox.

• high

  CVE-2025-65964: n8n Git Node Remote Code Execution via core.hooksPath

  Any authenticated n8n user who can build workflows can plant a malicious Git hook and trigger it through the Git node, running arbitrary commands as the n8n server process.

• high

  n8n: Shared-Workflow Editor Credential Bypass via Inline Sub-Workflow JSON

  A user with Editor access to any shared n8n workflow can embed a foreign credential ID inside an Execute Sub-workflow node's inline JSON, bypassing all credential permission checks and using or…

• high

  n8n Edit Image Node Format Injection Allows Arbitrary File Write

  The n8n Edit Image node accepted a user-controlled output format string without validation and passed it directly to GraphicsMagick, letting any authenticated workflow user write files to arbitrary…

• high

  n8n Edit Fields (Set) Node Prototype Pollution Denial of Service

  An authenticated n8n user can name a workflow field '__proto__.hasOwnProperty' in the Edit Fields node, corrupting a shared global in the main Node.js process and crashing authentication for every…

• highCVE-2026-65595

  CVE-2026-65595: n8n Token Exchange Privilege Escalation via Full API Scope Assignment

  A low-privileged user with a valid external JWT can obtain a token exchange access token that carries every Public API scope, allowing them to perform admin-only actions like creating users, deleting…

• high

  n8n: Account Takeover via Unverified Email Claim in Embed Login Token Exchange

  A flaw in n8n's embed login feature lets an attacker with any token from a configured trusted key authenticate as any existing user by supplying that user's email address in the JWT, even if the…

• high

  n8n: Bypass Allowed HTTP Request Domains in AI and LLM Nodes

  A low-privileged n8n user with use-only access to a shared credential could redirect AI and LLM node traffic to an attacker-controlled server, leaking the credential secret, because several AI nodes…

• highCVE-2026-56816

  CVE-2026-56816: netty-codec-http3 Memory Exhaustion via Reserved Frame Types

  Netty's HTTP/3 codec blindly trusts the payload length declared in reserved frame types, letting an attacker open many QUIC streams and declare multi-gigabyte frames to exhaust server memory and…

• highCVE-2026-56817

  CVE-2026-56817: netty-codec-xml XmlDecoder XML External Entity Injection

  Netty's XmlDecoder uses an unconfigured XML parser that leaves DTD and external entity processing enabled by default, letting any attacker who can send bytes into the pipeline attempt to read server…