CVE-2026-126385

n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback

n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-126386

n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerability in the unauthenticated MCP OAuth dynamic client registration flow, which accepts arbitrary redirect_uri values via the /mcp-oauth/register endpoint. Attackers can send victims crafted /mcp-oauth/authorize URLs that redirect them to attacker-controlled sites before instance checks run, enabling phishing.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-126387

n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool

n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-126388

n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes

n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or an expression-fed URL in credential-using nodes can capture stored workflow credentials sent to their endpoint.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-126389

n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat

n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-126390

n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download

n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-126391

n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape

n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-126392

Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Parseplatform

Products

Parse-server

CVE-2026-126393

SiYuan before 3.8.10 SSRF via Skill-Install Download Redirect and DNS Rebinding

SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebinds to loopback addresses, reaching internal services and metadata endpoints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

B3log

Products

Siyuan

CVE-2026-126394

vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames

vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu video_backend with a huge num_frames, forcing np.linspace allocations and CPU work that OOM-kill the API server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126395

vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()

vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126396

vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126397

vLLM 0.10.1 before 0.31.0 Cohere2 Vision DoS via max_patches

vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. Remote clients can send small image chat-completion requests with large, varying max_patches values to bypass the LRU cache, exhaust preprocessing workers, and deny service to other clients.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126398

vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models

vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only prompt_embeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126399

vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames

vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126400

Password Pusher 1.49.0 before 2.17.0 IP Spoofing via Unanchored Trusted-Proxy Regex

Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify audit log entries and shift password generator rate limits.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126401

Fleet before 4.86.2 Unauthenticated DoS via SSO Callback XML Canonicalization

Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Fleetdm

Products

Fleet

CVE-2026-126402

Fleet before 4.89.0 Broken Access Control via User Administration API

Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Fleetdm

Products

Fleet

CVE-2026-126403

Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint

Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Coder

Products

Coder

CVE-2026-126404

Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation

Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Coder

Products

Coder