CVE-2026-72772
HighAdvisory
Published 22 Jul 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.9
- base score, highest
- EPSS
- 0.004
- 37th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 6
- of 18,026 indexed, latest versions
- Container images
- 6
- deployed by those charts
- Fix available
- 1 of 1
- affected package
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
Carried by container images the latest versions of 6 of 18,026 indexed charts deploy, on 6 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| n8nnpm | 0.136.0, 0.212.0, 1.33.1, 1.86.0+2 more | 2.31.5 | 6 |
- OSV records
- GHSA-8342-988q-86cr
Charts affected
6 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| n8nn8n | 0.23.0 | 1 of 1See more | 6,261 |
| n8nlinogicsVerified publisher | 0.136.0 | 1 of 1See more | 7,582 |
| n8none-acre-fundVerified publisher | 0.1.52 | 1 of 3See more | 8,503 |
| n8nn8n-helm | 2.25.7 | 1 of 1See more | 3,835 |
| n8njanip81-helm-chartsVerified publisher | 0.1.4 | 1 of 1See more | 7,063 |
| n8nvictorlane | 1.0.18 | 1 of 1See more | 7,503 |
Container images carrying it
6 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| n8nio/ | 761374d4eb84 | n8n | 2.31.5 | 1 |
| n8nio/ | 8b39ed5a2de9 | n8n | 2.31.5 | 1 |
| n8nio/ | a9195bc499a3 | n8n | 2.31.5 | 1 |
| n8nio/ | dd171d45102a | n8n | 2.31.5 | 1 |
| n8nio/ | e8302e8bd402 | n8n | 2.31.5 | 1 |
| n8nio/ | ed16e560c40e | n8n | 2.31.5 | 1 |