n8n

n8n Workflow Automation Tool

Latest 2.42.7

90%

Total Score

healthy

Frequent releases, active contributors, and npm provenance make this a well-supported release despite workflow permission gaps.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package declares 158 runtime dependencies, which is a substantial dependency surface for a large automation platform. The signal provides no evidence that these dependencies are stale or unsafe, so this is only a modest complexity consideration.

Workflow audit

The audit covered only 30 of 111 workflows, so it is incomplete. It found high-confidence blanket GitHub App permissions and repeated secrets inheritance, plus an unpinned tool; however, there were no untrusted checkouts or script-injection findings, limiting the concern to workflow hygiene.

Vulnerabilities

Title	Versions	Severity
CVE-2026-86073 n8n is vulnerable to Incorrect Authorization in versions 2.38.0 - 2.38.1 and 0.0.0 - 2.37.7.	0.0.0 - 2.37.72.38.0 - 2.38.1	Medium
CVE-2026-86074 n8n is vulnerable to Server-Side Request Forgery (SSRF) in versions 2.38.0 - 2.38.2 and 0.0.0 - 2.37.7.	0.0.0 - 2.37.72.38.0 - 2.38.2	Medium
CVE-2026-86995 n8n is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.123.76, 2.38.0 - 2.38.2 and 2.0.0 - 2.37.7.	0.0.0 - 1.123.762.0.0 - 2.37.72.38.0 - 2.38.2	Medium
CVE-2026-86085 n8n is vulnerable to Missing Authorization in versions 2.38.0 - 2.38.2 and 0.0.0 - 2.37.7.	0.0.0 - 2.37.72.38.0 - 2.38.2	Medium
CVE-2026-86993 n8n is vulnerable to Missing Authorization in versions 0.0.0 - 1.123.76, 2.38.0 - 2.38.2 and 2.0.0 - 2.37.7.	0.0.0 - 1.123.762.0.0 - 2.37.72.38.0 - 2.38.2	Medium