Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-59207

  CVE-2026-59207: n8n AI Agents MCP Connector Allowed HTTP Request Domains Bypass

  A member-level n8n user with access to a domain-restricted credential can route that credential's secret to any server they control by pointing an AI Agents MCP tool at an arbitrary URL, completely…

• highCVE-2026-59208

  CVE-2026-59208: n8n Cross-Issuer JWT Token Exchange Account Takeover

  n8n's Enterprise token-exchange login matched incoming JWTs to user accounts using only the JWT subject claim, ignoring which issuer signed the token, letting an attacker with a valid token from one…

• highCVE-2026-65016

  CVE-2026-65016: n8n SSO Instance-Role Provisioning Privilege Escalation to Owner

  When n8n's Enterprise SSO role provisioning is enabled, an attacker who can control the instance-role claim sent by the Identity Provider can set it to the owner role, gaining full administrative…

• high

  n8n Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

  Authenticated n8n users can point a Git remote at an arbitrary local path and use the fetch, pull, or pushTags operations to read files and history from outside the intended sandbox.

• high

  CVE-2025-65964: n8n Git Node Remote Code Execution via core.hooksPath

  Any authenticated n8n user who can build workflows can plant a malicious Git hook and trigger it through the Git node, running arbitrary commands as the n8n server process.

• high

  n8n: Shared-Workflow Editor Credential Bypass via Inline Sub-Workflow JSON

  A user with Editor access to any shared n8n workflow can embed a foreign credential ID inside an Execute Sub-workflow node's inline JSON, bypassing all credential permission checks and using or…

• high

  n8n Edit Image Node Format Injection Allows Arbitrary File Write

  The n8n Edit Image node accepted a user-controlled output format string without validation and passed it directly to GraphicsMagick, letting any authenticated workflow user write files to arbitrary…

• high

  n8n Edit Fields (Set) Node Prototype Pollution Denial of Service

  An authenticated n8n user can name a workflow field '__proto__.hasOwnProperty' in the Edit Fields node, corrupting a shared global in the main Node.js process and crashing authentication for every…

• highCVE-2026-65595

  CVE-2026-65595: n8n Token Exchange Privilege Escalation via Full API Scope Assignment

  A low-privileged user with a valid external JWT can obtain a token exchange access token that carries every Public API scope, allowing them to perform admin-only actions like creating users, deleting…

• high

  n8n: Account Takeover via Unverified Email Claim in Embed Login Token Exchange

  A flaw in n8n's embed login feature lets an attacker with any token from a configured trusted key authenticate as any existing user by supplying that user's email address in the JWT, even if the…

• high

  n8n: Bypass Allowed HTTP Request Domains in AI and LLM Nodes

  A low-privileged n8n user with use-only access to a shared credential could redirect AI and LLM node traffic to an attacker-controlled server, leaking the credential secret, because several AI nodes…

• highCVE-2026-56816

  CVE-2026-56816: netty-codec-http3 Memory Exhaustion via Reserved Frame Types

  Netty's HTTP/3 codec blindly trusts the payload length declared in reserved frame types, letting an attacker open many QUIC streams and declare multi-gigabyte frames to exhaust server memory and…