CVE-2026-126384
Last modified
CVE-2026-126384 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance..
Description
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance.
Metrics
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-126384?
How severe is CVE-2026-126384?
How do I fix CVE-2026-126384?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-126378Vvveb through 1.0.8.6 contains a file upload vulnerability i…9.1
- CVE-2026-126379Vvveb 1.0.8.6 contains an incomplete server-side request for…7.6
- CVE-2026-126380Vvveb before 1.0.9.0 contains a denylist bypass in system/tr…9.1
- CVE-2026-126381n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.…6.3
- CVE-2026-126382n8n before 2.38.0 and 3.x before 3.0.1 contains a missing au…5.4
- CVE-2026-126383n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1…8.2
- CVE-2026-126385n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.…7.7
- CVE-2026-126386n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1…4.7
- CVE-2026-126387n8n before 2.46.1 contains an arbitrary file read vulnerabil…5.3
- CVE-2026-126388n8n before 2.46.1 contains a credential exposure vulnerabili…3.7
- CVE-2026-126389n8n before 1.123.89 contains an authentication bypass vulner…5.4
- CVE-2026-126390n8n before 1.123.89 contains a credential leakage vulnerabil…3.7
Are you affected by CVE-2026-126384?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST