Medium, CVSS 6.3
n8n: External Secrets Accessible via Workflow Expressions Outside Credentials
npm n8n · Upgrade to 2.28.1 or 2.27.4 by release line · >= 2.28.0, < 2.28.1; < 2.27.4 · CVE-2026-59254 · GHSA-2434-3x6q-8r99 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3501–3525 of 30,921 matching · newest first
- Medium, CVSS 5.3
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
npm n8n · Upgrade to 2.28.1, 2.27.4 or 1.123.61 by release line · < 1.123.61; >= 2.28.0, < 2.28.1; >= 2.0.0-rc.0, < 2.27.4 · CVE-2026-59257 · GHSA-hwmj-qg4v-cvg9 · amended
- Medium, CVSS 6.0
n8n: External Secrets Permission Bypass via Expression Parser Mismatch
npm n8n · Upgrade to 2.28.1, 2.27.4 or 1.123.61 by release line · < 1.123.61; >= 2.28.0, < 2.28.1; >= 2.0.0-rc.0, < 2.27.4 · CVE-2026-59259 · GHSA-jp7m-xcgx-57qm · amended
- Medium, CVSS 4.9
n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory
npm n8n · Upgrade to 2.32.1 or 2.31.5 by release line · >= 2.32.0, < 2.32.1; < 2.31.5 · CVE-2026-72773 · GHSA-pf2q-pxhf-hgmw · amended
- Medium, CVSS 6.1
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72769 · GHSA-hx4h-vr3m-45vh · amended
- High, CVSS 7.1
n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72749 · GHSA-xwx6-jjhv-84p8 · amended
- High, CVSS 7.7
n8n: Edit Image Node Format Injection Allows Arbitrary File Write
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72762 · GHSA-xmc9-4f2h-jf9c · amended
- High, CVSS 7.2
n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72763 · GHSA-cj9h-qx8g-pq2g · amended
- High, CVSS 7.1
n8n: Credential Authorization Bypass via Expression in HTTP Request Node
genericAuthTypenpm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72774 · GHSA-6qc9-mqvw-jg7x · amended
- High, CVSS 8.7
n8n: Expression sandbox escape via arrow-function bodies enabling command execution
npm n8n · Upgrade to 2.32.1 or 2.31.5 by release line · >= 2.32.0, < 2.32.1; < 2.31.5 · CVE-2026-72765 · GHSA-gv7g-jm28-cr3m · amended
- High, CVSS 8.2
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72766 · GHSA-2x35-3fw4-9jr4 · amended
- High, CVSS 8.7
n8n: Authenticated code execution in the n8n Git node
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72767 · GHSA-rcv6-pvrj-4xcg · amended
- Medium, CVSS 6.4
n8n: SSRF Protection Bypass via MCP Client Node
npm n8n · Upgrade to 2.32.1 or 2.31.5 by release line · >= 2.32.0, < 2.32.1; < 2.31.5 · CVE-2026-72768 · GHSA-vhf8-cg2h-cg3p · amended
- High, CVSS 7.1
n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72770 · GHSA-gf29-4f56-r2jf · amended
- High, CVSS 7.1
n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
npm n8n · Upgrade to 2.32.1 or 2.31.5 by release line · >= 2.32.0, < 2.32.1; < 2.31.5 · CVE-2026-72771 · GHSA-64xh-79j6-r5v8 · amended
- High, CVSS 8.9
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
npm n8n · Upgrade to 2.32.1 or 2.31.5 by release line · >= 2.32.0, < 2.32.1; < 2.31.5 · CVE-2026-72772 · GHSA-8342-988q-86cr · amended
- High, CVSS 7.7
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65016 · GHSA-35q8-9mj6-wjmf · amended
- High, CVSS 8.9
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65591 · GHSA-pm35-fqvh-cq5g · amended
- Medium, CVSS 6.3
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65593 · GHSA-9w78-79q7-r4fp · amended
- High, CVSS 8.9
n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
npm n8n · Upgrade to 2.30.1 or 2.29.8 by release line · >= 2.30.0, < 2.30.1; < 2.29.8 · CVE-2026-65595 · GHSA-777w-rpr6-c52h · amended
- High, CVSS 7.6
n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
npm n8n · Upgrade to 2.28.1 or 2.27.4 by release line · >= 2.28.0, < 2.28.1; < 2.27.4 · CVE-2026-59208 · GHSA-mq3m-f8x3-579w · amended
- High, CVSS 7.1
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
npm n8n · Upgrade to 2.28.1 or 2.27.4 by release line · >= 2.28.0, < 2.28.1; < 2.27.4 · CVE-2026-59207 · GHSA-h44j-f5r5-ph73 · amended
- High, CVSS 7.1
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
npm n8n · Upgrade to 2.28.1, 2.27.4 or 1.123.61 by release line · < 1.123.61; >= 2.28.0, < 2.28.1; >= 2.0.0-rc.0, < 2.27.4 · CVE-2026-59206 · GHSA-75qm-gp28-rcq9 · amended
- High, CVSS 7.1
n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
npm n8n · Upgrade to 2.28.1, 2.27.4 or 1.123.61 by release line · < 1.123.61; >= 2.28.0, < 2.28.1; >= 2.0.0-rc.0, < 2.27.4 · CVE-2026-59209 · GHSA-q3j5-8vrg-4p9q · amended
- Medium, CVSS 5.7
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-59921 · GHSA-gcjf-9mgh-3p7g
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.