By weakness (CWE)

CWE-488: related vulnerabilities

CVEs classified under CWE-488. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-54311HIGH 7.7

  n8n versions before 2.25.7 and 2.26.2 contain a cross-user data leak vulnerability in the Merge node's SQL Query mode. An authenticated user can craft a malicious workflow that modifies the shared sandbox environment, poisoning it for all subsequent SQL queries executed by other users on the same instance. This means workflows belonging to different users or projects can inadvertently expose sensitive data to attackers who have created a polluted sandbox. The vulnerability requires authenticated access and only impacts multi-user deployments where multiple users can create workflows with the Merge node.

• CVE-2026-46416MEDIUM 6.3

  Microsoft UFO, an open-source intelligent automation framework, has a flaw in how it manages WebSocket connections used for remote automation across devices and platforms. The vulnerability stems from improper reuse of a shared connection handler that processes authenticated user requests. When multiple users connect simultaneously, their connection contexts get mixed up—specifically, responses intended for one user can be delivered to another user who connected most recently. This allows an authenticated attacker to intercept and view responses that were meant for a different authenticated session, potentially exposing sensitive automation results or command outputs.

• CVE-2026-9831MEDIUM 6.3

  A timing vulnerability in Extreme Platform ONE's identity and access management (IAM) gateway could occasionally allow an authenticated user to view data belonging to a different customer organization. The issue occurs only under specific high-traffic conditions where concurrent API requests overlap, and only affects API-key-based authentication—not Extreme's newer token or OAuth methods. An attacker would need valid API credentials to attempt this, and success is not guaranteed; the flaw is triggered by race conditions in how the gateway validates which tenant's data should be returned.

• CVE-2026-14621LOW 3.1

  A logic flaw in FederatedAI FATE's OSX Broker component can cause session data to be routed to the wrong recipient when certain queue parameters are manipulated. An authenticated attacker can exploit improper validation of the rollSiteSessionId, dstRole, and dstPartyId arguments to leak sensitive data between federated learning sessions. The vulnerability is difficult to exploit in practice and requires authenticated access, keeping real-world risk relatively contained.