Four vulnerabilities in n8n, topped by an expression compiler sanitizer bypass due to dynamically scoped this leading to code execution, and an OAuth Dynamic Client Registration endpoint issue with unbounded redirect_uris. Others include a path traversal in the Git node clone operation allowing writes to arbitrary directory paths, and an SSRF bypass in the OpenAI Chat Model node using URL fragments. Affected: n8n < 1.123.76 / < 2.37.7 / < 2.38.2. Upgrade to 1.123.76, 2.37.7, or 2.38.2.

CVE IDs: CVE-2026-86076, CVE-2026-86075, CVE-2026-86081, CVE-2026-86082.