https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-119408/https://vulnfeed.org/cve/CVE-2026-119408/Fri, 30 Oct 2026 12:16:37 +0000n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.https://vulnfeed.org/cve/CVE-2026-118679/https://vulnfeed.org/cve/CVE-2026-118679/Wed, 28 Oct 2026 19:17:34 +0000n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.https://vulnfeed.org/cve/CVE-2026-118648/https://vulnfeed.org/cve/CVE-2026-118648/Wed, 28 Oct 2026 19:17:33 +0000n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.https://vulnfeed.org/cve/CVE-2026-118675/https://vulnfeed.org/cve/CVE-2026-118675/Wed, 28 Oct 2026 19:17:33 +0000n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.https://vulnfeed.org/cve/CVE-2026-118676/https://vulnfeed.org/cve/CVE-2026-118676/Wed, 28 Oct 2026 19:17:33 +0000n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted credential values to be sent to attacker-chosen destinations.https://vulnfeed.org/cve/CVE-2026-118642/https://vulnfeed.org/cve/CVE-2026-118642/Wed, 28 Oct 2026 19:17:32 +0000n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.https://vulnfeed.org/cve/CVE-2026-118643/https://vulnfeed.org/cve/CVE-2026-118643/Wed, 28 Oct 2026 19:17:32 +0000n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.https://vulnfeed.org/cve/CVE-2026-118644/https://vulnfeed.org/cve/CVE-2026-118644/Wed, 28 Oct 2026 19:17:32 +0000n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.https://vulnfeed.org/cve/CVE-2026-118647/https://vulnfeed.org/cve/CVE-2026-118647/Wed, 28 Oct 2026 19:17:32 +0000n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.