CVE Watch14 jul 2026

CVE-2026-59208

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than

CVSS

6.8

Medio

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 9 jul 2026 · Última mod.: 14 jul 2026 · CWE-287 · CWE-346

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-07-102026-07-16

Descripción técnica

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-342918.8 ALT

99.6%

KEV—80Langflow Origin Validation Error Vulnerability3d CVE-2026-468179.8 CRÍ

60.3%

KEV—68Oracle E-Business Suite Improper Privilege Management Vulnerability1d CVE-2023-278239.8 CRÍ

98.9%

——30An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.9d CVE-2022-470039.8 CRÍ

88.2%

——26A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.9d CVE-2026-242947.8 ALT

84.6%

——25Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.16d CVE-2020-288747.5 ALT

81.8%

——25reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).9d