Description Summary:
n8n contains an expression sandbox escape in the $fromAI handler that allows authenticated users with workflow-build privileges to achieve remote code execution via prototype chain manipulation.

Executive Summary:
A critical sandbox escape vulnerability in n8n allows authenticated attackers to execute arbitrary code on the host system via the $fromAI handler.

Vulnerability Details

CVE-ID: CVE-2026-85169

Affected Software: n8n-io n8n

Affected Versions: 0 up to 1.123.73, 2.35.4, and 2.36.2

Vulnerability: The vulnerability exists in the $fromAI expression handler, which fails to properly validate placeholder names. An attacker with workflow-build permissions can exploit this to walk the prototype chain, access the Function constructor, and execute arbitrary code within the main n8n process.

Business Impact

A successful exploit grants an attacker the ability to execute arbitrary code on the server hosting the n8n application. This level of access typically results in full system compromise, data exfiltration, and the potential for lateral movement within the internal network. With a CVSS score of 8.7, this flaw represents a significant risk to organizational integrity, especially in environments where n8n has access to sensitive integrations or internal credentials.

Remediation Plan

Immediate Action: Update n8n instances to version 1.123.73, 2.35.4, 2.36.2, or later to incorporate the security patch for the $fromAI handler.

Proactive Monitoring: Review workflow logs for suspicious expressions or attempts to access restricted object prototypes. Monitor system logs for unexpected process execution or unauthorized network connections originating from the n8n service account.

Compensating Controls: Restrict workflow-build privileges to trusted users only. Implement network segmentation to ensure the n8n instance operates with minimal necessary permissions to reduce the impact of a potential compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of prototype pollution and code execution, but it currently requires an attacker to possess existing workflow-build privileges.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a severe threat to any deployment of n8n. Administrators must prioritize the application of the provided security patches across all production environments. Restricting access to workflow-building capabilities remains a critical secondary defense while the update is being staged and deployed.

Description Summary:
n8n is vulnerable to OS command injection, allowing authenticated users to execute arbitrary commands on the underlying system.

Executive Summary:
An OS command injection vulnerability in n8n allows authenticated attackers to execute arbitrary code on the server, posing a critical threat to system security.

Vulnerability Details

CVE-ID: CVE-2026-77080

Affected Software: n8n-io n8n

Affected Versions: 0 up to (excluding) 1.123.69, 0 up to (excluding) 2.34.1, 0 up to (excluding) 2.33.4

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) where input is not properly neutralized before being passed to system-level commands. An authenticated attacker can leverage this to gain unauthorized control over the server environment.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the n8n application process, leading to full system compromise. The CVSS score of 8.7 highlights the extreme danger this poses to the confidentiality, integrity, and availability of the host system.

Remediation Plan

Immediate Action: Update n8n to version 1.123.69, 2.34.1, or 2.33.4, depending on the current branch in use.

Proactive Monitoring: Monitor for unauthorized process execution, unusual system calls, or suspicious network connections originating from the n8n service account.

Compensating Controls: Use strict process isolation and least-privilege configurations for the n8n container or service to limit the potential blast radius of a successful injection.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection flaws are highly critical and should be treated with the highest priority for remediation.

Analyst Recommendation

Given the potential for complete system takeover, applying the vendor-provided security updates is mandatory. Organizations must verify their current version and move to the patched releases immediately to eliminate the risk of remote command execution.

Description Summary:
An expression injection vulnerability in the n8n resource locator allows authenticated users to execute arbitrary code or inject malicious expressions.

Executive Summary:
An authenticated expression injection vulnerability in n8n allows for unauthorized code execution, presenting a critical risk to the security of the application and integrated data.

Vulnerability Details

CVE-ID: CVE-2026-77075

Affected Software: n8n-io n8n

Affected Versions: 0.x up to 1.123.69, 2.0.0 to 2.33.3, and 2.34.0

Vulnerability: This is a code injection vulnerability (CWE-94) involving improper control of code generation within the expression engine. The vulnerability requires authentication to access the resource locator, where an attacker can supply malicious input that results in unintended code execution.

Business Impact

Successful exploitation leads to unauthorized code execution, which can result in full system compromise, data exfiltration, or lateral movement within the environment. The CVSS score of 8.4 reflects the high severity of this vulnerability, emphasizing the risk to core infrastructure and business operations.

Remediation Plan

Immediate Action: Update n8n to version 1.123.69, 2.33.4, or 2.34.1 to patch the expression injection flaw.

Proactive Monitoring: Monitor workflow execution logs for unexpected or unauthorized expression patterns that deviate from standard operational behavior.

Compensating Controls: Utilize role-based access control to limit who can modify workflows or access resource locators, thereby reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dangerous due to the potential for direct code execution within the application server.

Analyst Recommendation

Immediate patching is required to address this vulnerability. Because code injection allows an attacker to bypass standard application logic and execute arbitrary commands, organizations should treat this update with the highest urgency to prevent potential system-wide compromise.

Description Summary:
A stored Cross-site Scripting (XSS) vulnerability exists in the n8n form completion page, allowing authenticated users to inject malicious scripts.

Executive Summary:
An authenticated stored Cross-site Scripting vulnerability in n8n allows attackers to execute arbitrary scripts in the context of other users, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-77072

Affected Software: n8n-io n8n

Affected Versions: 0.x up to 1.123.69, 2.0.0 to 2.33.3, and 2.34.0

Vulnerability: This is a stored Cross-site Scripting (XSS) vulnerability (CWE-79) triggered via the form completion page. The vulnerability requires the attacker to be an authenticated user to perform the injection, which then executes in the browser of other users who view the affected page.

Business Impact

A successful XSS attack can allow an attacker to hijack user sessions, steal sensitive data, or perform unauthorized actions on behalf of the victim. With a CVSS score of 8.4, this vulnerability presents a high-severity threat to organizational data integrity and user account security.

Remediation Plan

Immediate Action: Update n8n to version 1.123.69, 2.33.4, or 2.34.1, depending on the current deployment branch.

Proactive Monitoring: Review application logs for suspicious script injections or unusual activity within form configuration settings.

Compensating Controls: Employ a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser environment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of stored XSS makes it a persistent threat once injected, as it affects any user interacting with the compromised form.

Analyst Recommendation

Administrators must apply the provided security updates immediately to eliminate the XSS vector. Given the high severity and the potential for session hijacking, ensuring all instances of n8n are updated is critical to protecting user credentials and sensitive workflow data.

Description Summary:
A path traversal vulnerability in n8n allows authenticated users to access or modify files outside of intended directories.

Executive Summary:
A path traversal vulnerability in n8n allows authenticated attackers to perform unauthorized file operations, creating a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-77068

Affected Software: n8n-io n8n

Affected Versions: 0 up to (excluding) 2.34.1, 0 up to (excluding) 2.33.4

Vulnerability: The application suffers from a path traversal vulnerability (CWE-22) that allows an authenticated user to escape the intended directory structure. This occurs when processing file paths, potentially granting access to sensitive system files.

Business Impact

An attacker with valid application credentials could leverage this flaw to read configuration files or overwrite critical system files, potentially leading to remote code execution or data theft. The CVSS score of 8.7 reflects the high potential for total impact on the confidentiality and integrity of the affected server.

Remediation Plan

Immediate Action: Update n8n to version 2.34.1 or 2.33.4, or the latest available release, to patch the traversal flaw.

Proactive Monitoring: Review audit logs for suspicious file system interactions or access attempts to files outside the expected data storage paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing directory traversal sequences like double dots and slashes.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically trivial to exploit once an attacker has authenticated access to the platform.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update to the specified patched versions. Organizations should ensure their n8n instances are updated promptly to mitigate the risk of unauthorized file system interaction.

Description Summary:
A weak password recovery mechanism in n8n-io n8n allows authenticated attackers to potentially bypass authentication protocols via token exchange.

Executive Summary:
A critical authentication bypass vulnerability in n8n-io n8n allows authenticated attackers to manipulate token exchange mechanisms, risking full system access.

Vulnerability Details

CVE-ID: CVE-2026-72772

Affected Software: n8n-io n8n

Affected Versions: 0 up to 2.32.1, 0 up to 2.31.5

Vulnerability: This vulnerability involves a weak password recovery mechanism (CWE-640) that can be exploited by an authenticated user to perform an authentication bypass. The vulnerability leverages flaws in the token exchange process to elevate privileges or hijack sessions.

Business Impact

With a CVSS score of 8.9, this vulnerability presents a significant risk to workflow automation security. Successful exploitation could allow an attacker to hijack active sessions or bypass authentication, granting them full control over workflows, connected credentials, and integrated third-party services.

Remediation Plan

Immediate Action: Update the n8n installation to version 2.32.1 or 2.31.5 immediately to resolve the token exchange flaw.

Proactive Monitoring: Review application and access logs for suspicious token exchange patterns or unauthorized account access events.

Compensating Controls: Restrict access to the n8n administrative interface to known IP addresses and enforce multi-factor authentication (MFA) where possible to mitigate the impact of compromised credentials.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to its potential to bypass core authentication security controls.

Analyst Recommendation

This flaw requires urgent attention due to the high severity and the potential for complete system compromise. Administrators must apply the vendor-provided patches (2.32.1 or 2.31.5) as soon as possible to secure the n8n platform against potential exploitation.

Description Summary:
n8n is vulnerable to OS command injection via the Git node, which allows authenticated users to execute arbitrary commands on the underlying host.

Executive Summary:
A critical OS command injection vulnerability in the n8n Git node allows an authenticated attacker to execute arbitrary commands, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72767

Affected Software: n8n-io n8n

Affected Versions: 0 up to (excluding) 1.123.67, 2.32.1, and 2.31.5

Vulnerability: This flaw (CWE-78) occurs in the Git node, where improper neutralization of special elements allows an authenticated attacker to inject and execute arbitrary OS commands on the host server.

Business Impact

Exploitation of this vulnerability grants an attacker the ability to run arbitrary commands with the privileges of the n8n service, which can lead to data theft, lateral movement, or complete system takeover. With a CVSS score of 8.7, this vulnerability represents a high-risk scenario for organizations utilizing the Git integration in their workflows.

Remediation Plan

Immediate Action: Update n8n to version 1.123.67, 2.32.1, or 2.31.5 as appropriate for your current deployment branch.

Proactive Monitoring: Review audit logs for suspicious Git-related operations and monitor for unusual child processes spawned by the n8n application.

Compensating Controls: If immediate patching is not feasible, restrict user access to the Git node functionality and ensure the application is running in a highly restricted, non-privileged container environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable if a user can manipulate input parameters passed to the Git node.

Analyst Recommendation

Administrators must treat this vulnerability with high urgency. Applying the provided updates is the only effective way to remediate this command injection risk and ensure the continued security of the host infrastructure.

Description Summary:
n8n is vulnerable to a sandbox escape that allows authenticated users to perform remote code execution.

Executive Summary:
A critical remote code execution vulnerability exists in n8n due to an improper expression sandbox escape, which could allow an authenticated attacker to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72765

Affected Software: n8n-io n8n

Affected Versions: 0 up to (excluding) 2.32.1 and 0 up to (excluding) 2.31.5

Vulnerability: This vulnerability involves a code injection flaw (CWE-94) within the expression sandbox, which permits an authenticated user with low privileges to bypass security restrictions and execute arbitrary system commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to compromise the host server, potentially leading to full system takeover and unauthorized access to sensitive workflow data. Given the CVSS score of 8.7, this is a high-severity issue that poses a significant risk to the confidentiality, integrity, and availability of the affected environment.

Remediation Plan

Immediate Action: Update n8n to version 2.32.1 or 2.31.5 immediately to incorporate the necessary sandbox security patches.

Proactive Monitoring: Monitor server logs for unexpected process execution or abnormal outbound network connections originating from the n8n application service.

Compensating Controls: Ensure the n8n instance is running with the least privilege necessary, and consider isolating the application within a containerized environment with restricted egress traffic to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for sandbox escape, which bypasses intended security boundaries.

Analyst Recommendation

The severity of this remote code execution vulnerability necessitates immediate action. Administrators must prioritize updating to the specified patched versions to prevent potential compromise of their n8n automation infrastructure.

Description Summary:
A Time-of-check Time-of-use (TOCTOU) race condition exists in the n8n workflow automation platform that could allow authenticated users to impact system integrity.

Executive Summary:
A race condition vulnerability in the n8n workflow automation platform, identified as CVE-2026-71539, poses a high risk to system integrity for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-71539

Affected Software: n8n-io n8n

Affected Versions: < 1.123.64, >= 2.0.0-rc.0, < 2.29.8, >= 2.30.0, < 2.30.1

Vulnerability: This vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). It requires an attacker to have low-level authenticated access to the platform to exploit the flaw.

Business Impact

Successful exploitation of this TOCTOU race condition could lead to unauthorized data modification or system instability within the workflow environment. Given the CVSS score of 8.9, this vulnerability is classified as high severity, reflecting the potential for significant impact on automated business processes and data handled by the n8n platform.

Remediation Plan

Immediate Action: Update the n8n installation to version 1.123.64, 2.29.8, or 2.30.1 immediately to apply the vendor-supplied fix.

Proactive Monitoring: Monitor system access logs for unusual patterns or bursts of requests that could indicate an attempt to exploit race conditions during workflow execution.

Compensating Controls: Ensure that the n8n instance is protected by robust network access controls, limiting exposure to untrusted users who could leverage this vulnerability.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The severity of this vulnerability necessitates prompt action to secure your workflow automation environment. Administrators must prioritize updating to the patched versions provided by n8n-io to mitigate the risk of race condition exploitation.

Description Summary:
n8n is vulnerable to remote code execution via a time-of-check time-of-use race condition during Git clone operations.

Executive Summary:
A race condition in n8n allows authenticated attackers to achieve remote code execution during Git repository interactions, threatening the host environment.

Vulnerability Details

CVE-ID: CVE-2026-65598

Affected Software: n8n-io n8n

Affected Versions: Versions prior to 1.123.64, 2.30.1, and 2.29.8

Vulnerability: The software contains a time-of-check time-of-use (TOCTOU) race condition during the Git clone process. An authenticated attacker can manipulate this timing to inject malicious payloads, leading to remote code execution.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the server hosting n8n. This breach can result in the loss of proprietary workflows, credentials stored within the tool, and potential lateral movement into the internal network. The high CVSS score of 8.9 reflects the significant danger posed by this remote code execution capability.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates by upgrading to version 1.123.64, 2.30.1, or 2.29.8.

Proactive Monitoring: Monitor server logs for unexpected process execution or abnormal Git-related activity occurring within the n8n application environment.

Compensating Controls: Restrict the ability of the n8n service to initiate external connections to untrusted Git repositories if such functionality is not strictly required for business operations.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Race conditions are inherently complex to exploit, typically requiring precise timing, yet they remain a critical risk due to the potential for full system compromise.

Analyst Recommendation

Administrators must perform the recommended software update immediately. Given the technical nature of this race condition, patching is the only reliable method to eliminate the vulnerability.

Description Summary:
A DOM-based Cross-site Scripting (XSS) vulnerability exists in n8n due to improper neutralization of input within unsandboxed iframes.

Executive Summary:
A DOM-based XSS vulnerability in n8n allows authenticated users to execute malicious scripts, potentially leading to unauthorized data access or session compromise.

Vulnerability Details

CVE-ID: CVE-2026-65597

Affected Software: n8n-io n8n

Affected Versions: 0 up to (excluding) 1.123.64, 2.30.1, and 2.29.8

Vulnerability: This is a DOM-based Cross-site Scripting (XSS) flaw categorized under CWE-79. The vulnerability occurs because the application fails to properly sanitize input when handling unsandboxed iframes, allowing an authenticated user with low privileges to trigger script execution in the context of the victim's session.

Business Impact

The successful exploitation of this vulnerability could allow an attacker to hijack user sessions, perform unauthorized actions on behalf of other users, or exfiltrate sensitive workflow data. With a CVSS score of 8.2, this high-severity flaw represents a significant risk to the integrity and confidentiality of the n8n automation platform.

Remediation Plan

Immediate Action: Update the n8n software to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Monitor web application logs for suspicious script injections or unusual iframe-related requests originating from authenticated user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common XSS attack patterns in incoming HTTP requests.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw requires authenticated access, the ability to execute arbitrary scripts in a browser environment poses a notable risk to multi-user environments.

Analyst Recommendation

Given the high CVSS score, administrators should prioritize updating their n8n instances immediately. Applying the provided patch is the only reliable method to remediate the underlying DOM-based XSS flaw and protect the integrity of user sessions within the platform.

Description Summary:
n8n is susceptible to a privilege escalation vulnerability via improper token exchange management.

Executive Summary:
An authenticated privilege escalation vulnerability in n8n allows users to bypass intended security boundaries via token exchange, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-65595

Affected Software: n8n-io n8n

Affected Versions: Versions prior to 2.30.1 and 2.29.8

Vulnerability: The application suffers from improper privilege management during the token exchange process. An authenticated attacker can exploit this weakness to escalate their privileges, potentially gaining unauthorized administrative control over the application.

Business Impact

This vulnerability allows a standard user to gain elevated permissions, effectively bypassing the role-based access control mechanisms of the platform. This could result in unauthorized access to sensitive workflows, credentials, and business data. With a CVSS score of 8.9, the potential for total impact on the confidentiality and integrity of the application is high.

Remediation Plan

Immediate Action: Upgrade to n8n version 2.30.1 or 2.29.8 to resolve the token exchange vulnerability.

Proactive Monitoring: Monitor authentication logs for unusual token request patterns or unauthorized elevation attempts by standard user accounts.

Compensating Controls: Enforce strict access control policies and review user roles within the n8n console to identify and remove any accounts with excessive permissions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access limits the attack surface, but the potential for internal privilege escalation remains a significant concern.

Analyst Recommendation

Organizations should prioritize the deployment of the security update to close the privilege management gap. Ensuring that all users operate with the principle of least privilege will further reduce the risk of internal abuse.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in n8n allows for the execution of malicious scripts via the cached result URL parameter.

Executive Summary:
n8n versions prior to 1.123.64, 2.30.1, and 2.29.8 are vulnerable to a stored cross-site scripting attack that could lead to unauthorized user actions.

Vulnerability Details

CVE-ID: CVE-2026-65592

Affected Software: n8n

Affected Versions: 0 up to (excluding) 1.123.64, 2.30.1, and 2.29.8

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered via the cached result URL. An authenticated attacker can inject malicious scripts that execute in the context of other users, including administrators, when they view the affected data.

Business Impact

The CVSS score of 8.4 reflects the high risk of this vulnerability. An XSS attack can be used to hijack user sessions, perform unauthorized actions on behalf of the victim, or redirect users to malicious sites, potentially compromising the integrity of workflows managed within the n8n platform.

Remediation Plan

Immediate Action: Update n8n to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Monitor for suspicious script injections or unusual activity in workflow logs and user access logs.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by authenticated users, making it a critical concern for multi-user environments.

Analyst Recommendation

Administrators must prioritize updating their n8n instances to the specified fixed versions. Given the potential for session hijacking, ensuring that all users are on patched versions is essential to maintaining the security of workflow automations.

Description Summary:
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler, allowing for potential expression language injection.

Executive Summary:
A high-severity expression language injection vulnerability in n8n allows authenticated attackers to bypass security sanitizers and achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65591

Affected Software: n8n-io n8n

Affected Versions: Versions prior to 1.123.64, 2.30.1, and 2.29.8

Vulnerability: This vulnerability involves an improper neutralization of special elements in the legacy expression evaluator. An authenticated user can leverage this flaw to inject malicious expressions, leading to potential unauthorized code execution on the underlying host.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it allows for arbitrary code execution with the privileges of the n8n service. This can lead to complete system compromise, unauthorized data exfiltration, and lateral movement within the network. Given the CVSS score of 8.9, this vulnerability is considered a critical priority for remediation.

Remediation Plan

Immediate Action: Update n8n to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Review audit logs for suspicious expression evaluations or attempts to access system-level files through workflow nodes.

Compensating Controls: Implement strict network segmentation for the n8n instance and ensure the service runs with the least privilege necessary to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated attacker, which serves as a primary, though not absolute, defense against external mass-exploitation attempts.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Administrators must verify their current n8n version and apply the provided patches without delay to prevent potential remote code execution.

Description Summary:
The n8n workflow automation tool contains an authorization bypass vulnerability that allows authenticated users to escalate privileges via user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in n8n allows authenticated users to escalate privileges, posing a risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65016

Affected Software: n8n

Affected Versions: 0 up to 1.123.64, 2.30.1, and 2.29.8

Vulnerability: This vulnerability is an authorization bypass (CWE-639) triggered by user-controlled keys. The flaw permits an authenticated user to perform unauthorized actions or gain elevated privileges, effectively bypassing existing security controls within the n8n application.

Business Impact

The ability to bypass authorization mechanisms presents a critical risk to the integrity and confidentiality of the n8n instance. An attacker could gain unauthorized administrative control over workflows or sensitive data, leading to a total compromise of the application environment. The CVSS score of 7.7 reflects the high impact on data and service integrity.

Remediation Plan

Immediate Action: Update the n8n application to version 1.123.64, 2.30.1, or 2.29.8, depending on the specific branch in use.

Proactive Monitoring: Review application logs for unusual administrative activity or unauthorized access attempts associated with user sessions and SSO integration.

Compensating Controls: Restrict access to the n8n instance to trusted internal networks and utilize strong authentication methods to minimize the risk of compromised user credentials.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it a primary target for attackers seeking to escalate privileges within workflow automation platforms.

Analyst Recommendation

Because this vulnerability allows for privilege escalation, it represents a significant threat to the security posture of the n8n deployment. Administrators must apply the provided updates immediately to ensure that authorization logic is correctly enforced and to prevent potential unauthorized access.

Description Summary:
The n8n workflow automation platform contains vulnerabilities related to improper authentication and origin validation, which may allow an authenticated user to perform unauthorized actions.

Executive Summary:
An improper authentication and origin validation vulnerability in n8n allows authenticated users to compromise the integrity of workflow automation processes.

Vulnerability Details

CVE-ID: CVE-2026-59208

Affected Software: n8n-io n8n

Affected Versions: >= 2.28.0, < 2.28.1, and < 2.27.4

Vulnerability: The vulnerability stems from improper authentication (CWE-287) and origin validation errors (CWE-346). An authenticated attacker can exploit these flaws to bypass security checks and interfere with workflow execution, potentially leading to unauthorized data manipulation within the automation environment.

Business Impact

With a CVSS score of 7.6, this vulnerability represents a significant risk to the reliability and security of automated business workflows. Successful exploitation could allow attackers to alter critical business processes, exfiltrate data processed by n8n, or manipulate downstream systems integrated with the platform, leading to potential operational disruption and data integrity loss.

Remediation Plan

Immediate Action: Update n8n instances to version 2.28.1 or 2.27.4 (or the latest available release) to ensure authentication and origin validation checks are correctly enforced.

Proactive Monitoring: Monitor workflow execution logs for unexpected modifications or unauthorized access patterns that deviate from standard operational baselines.

Compensating Controls: Restrict access to the n8n dashboard via IP allowlisting or VPN requirements, and ensure that only trusted origins are permitted to communicate with the n8n API.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of n8n in managing sensitive business automation, the identified authentication and origin validation flaws must be addressed urgently. Organizations should immediately verify their current version and apply the recommended patches to prevent potential unauthorized manipulation of critical workflows.

Description Summary:
The n8n workflow automation platform contains a vulnerability that may allow for unauthorized system interaction or data exposure.

Executive Summary:
A high-severity vulnerability in the n8n automation platform poses a significant risk to workflow integrity and sensitive data security.

Vulnerability Details

CVE-ID: CVE-2026-54309

Affected Software: n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the n8n workflow automation platform, potentially exposing the application to unauthorized actions. The specific authentication requirements are currently undefined; however, the nature of workflow automation tools often necessitates strict access controls to prevent unauthorized task execution.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized workflow execution, potentially resulting in data exfiltration, unauthorized API calls, or the compromise of integrated third-party services. With a CVSS score of 8.8, this flaw represents a high risk to business operations, particularly for organizations relying on n8n for critical automation and data orchestration.

Remediation Plan

Immediate Action: Review the official n8n security advisory and apply the latest security patches or version updates to the platform immediately.

Proactive Monitoring: Monitor application access logs for unusual patterns, unauthorized workflow triggers, or unexpected outbound network connections originating from the n8n instance.

Compensating Controls: Implement strict network segmentation and restrict access to the n8n interface to trusted IP ranges via a Web Application Firewall (WAF) or VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of automation platforms in modern infrastructure, the potential for lateral movement or data compromise is substantial. Administrators must prioritize the identification of the affected versions within their environment and apply the necessary patches as soon as they become available to mitigate the risk of unauthorized access.

Description Summary:
A security vulnerability has been identified in the n8n workflow automation platform that may allow for unauthorized system interaction.

Executive Summary:
The n8n workflow automation platform is susceptible to a high-severity vulnerability that poses a significant risk of unauthorized access and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-54307

Affected Software: n8n n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the application's workflow processing logic, which may permit an authenticated attacker to execute unauthorized actions or bypass intended security constraints.

Business Impact

With a CVSS score of 8.5, this vulnerability is classified as High severity, indicating a substantial risk to operational integrity. Successful exploitation could lead to the unauthorized execution of automated workflows, potentially resulting in data exfiltration, service disruption, or the compromise of sensitive credentials managed within the platform.

Remediation Plan

Immediate Action: Review the official n8n security advisory and apply the latest security patches or version updates immediately to mitigate the risk.

Proactive Monitoring: Monitor system access logs for anomalous workflow execution patterns or unauthorized attempts to access administrative endpoints.

Compensating Controls: Implement strict network segmentation and ensure that the n8n instance is not exposed to the public internet without a robust Web Application Firewall (WAF) or VPN gateway.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations utilizing n8n must treat this vulnerability as a priority. Administrators should verify their current deployment version against the vendor's security documentation and prioritize the installation of all recommended updates to prevent potential exploitation.

Description Summary:
A security vulnerability has been identified in the n8n workflow automation platform that could potentially be leveraged to impact system integrity.

Executive Summary:
The n8n workflow automation platform is susceptible to a high-severity vulnerability that necessitates immediate attention to prevent unauthorized system manipulation.

Vulnerability Details

CVE-ID: CVE-2026-54305

Affected Software: n8n n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core functionality of the n8n automation platform. It potentially allows for unauthorized actions within the workflow engine, necessitating a review of current user permissions and workflow execution contexts.

Business Impact

The impact of this vulnerability includes the potential for unauthorized data processing or workflow manipulation, which could disrupt automated business processes. A CVSS score of 8.9 confirms that this is a high-priority issue that could lead to severe operational downtime or the leakage of sensitive data integrated into automation flows.

Remediation Plan

Immediate Action: Update to the latest available version of n8n as recommended by the vendor to resolve the underlying security issue.

Proactive Monitoring: Monitor system logs for unexpected workflow triggers or modifications that deviate from established operational baselines.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for patterns associated with common automation platform exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency. Applying the vendor-supplied patch is the most effective way to mitigate this risk, and it should be followed by an audit of all active workflows to ensure no unauthorized configurations were introduced prior to the update.

Description Summary:
A security vulnerability exists in the n8n workflow automation platform that may allow for unauthorized system interaction.

Executive Summary:
The n8n workflow automation platform contains a high-severity vulnerability that could permit unauthorized access or system manipulation.

Vulnerability Details

CVE-ID: CVE-2026-45732

Affected Software: n8n-io n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to flaws within the n8n automation framework that potentially expose sensitive workflow data or system execution capabilities to unauthorized parties. Given the nature of workflow automation tools, this often involves improper handling of authenticated requests or insecure configuration defaults.

Business Impact

Successful exploitation poses a severe risk to organizational operations, potentially leading to the compromise of automated workflows, unauthorized data exfiltration, or the execution of malicious tasks within the target environment. With a CVSS score of 8.3, this vulnerability is classified as High, indicating a significant potential for operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Update the n8n instance to the latest version provided by the vendor to ensure all security patches are applied.

Proactive Monitoring: Review audit logs for unusual workflow executions or unauthorized access attempts originating from unexpected IP addresses.

Compensating Controls: Implement strict network segmentation and ensure the n8n interface is not exposed to the public internet without robust authentication and WAF protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role workflow automation platforms play in modern infrastructure, the risk posed by this vulnerability is substantial. Organizations should prioritize patching their n8n deployments immediately to prevent potential exploitation.

Description Summary:
A security vulnerability has been identified in the n8n workflow automation platform that may allow for unauthorized access or system impact.

Executive Summary:
The n8n workflow automation platform contains a high-severity vulnerability that could lead to significant unauthorized system access if left unpatched.

Vulnerability Details

CVE-ID: CVE-2026-44792

Affected Software: n8n n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the n8n workflow automation environment, potentially allowing an attacker to manipulate workflow processes. Given the nature of automation platforms, this vulnerability likely requires varying levels of authentication depending on the specific workflow configuration.

Business Impact

Successful exploitation of this flaw could result in the unauthorized execution of automated workflows, leading to potential data exfiltration, unauthorized API interactions, or the compromise of connected third-party services. With a CVSS score of 8.9, this vulnerability presents a high risk to business operations, particularly for organizations relying on n8n for critical data orchestration and pipeline management.

Remediation Plan

Immediate Action: Identify the current n8n version and apply the latest security updates provided by the vendor immediately.

Proactive Monitoring: Review audit logs for unusual workflow executions or unauthorized access to sensitive node configurations.

Compensating Controls: Implement strict network access controls and ensure the n8n instance is not exposed to the public internet without proper authentication gateways.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, immediate patching is required to prevent potential workflow hijacking. Organizations should prioritize updating their n8n instances and performing a comprehensive review of existing workflow logs to identify any indicators of compromise.

Description Summary:
An authenticated workflow bypass vulnerability in the n8n XML node allows for Remote Code Execution (RCE) when chained with other nodes.

Executive Summary:
A critical authentication bypass in the n8n XML node allows authenticated users to achieve Remote Code Execution on the host server by chaining vulnerable operations.

Vulnerability Details

CVE-ID: CVE-2026-44791

Affected Software: n8n n8n

Affected Versions: Prior to 1.123.43, 2.22.1, and 2.20.7

Vulnerability: This vulnerability is an authentication bypass that invalidates a previous security patch for the XML node. By crafting specific workflows, an authenticated attacker can execute arbitrary code on the n8n host, circumventing existing functional restrictions.

Business Impact

The potential for Remote Code Execution carries the highest level of risk, as it grants an attacker full control over the application server. With a CVSS score of 9.4, this vulnerability could lead to total data breaches, lateral movement into internal networks, and permanent loss of system integrity.

Remediation Plan

Immediate Action: Upgrade to version 1.123.43, 2.22.1, or 2.20.7 to restore security protections for the XML node.

Proactive Monitoring: Monitor for anomalous process execution or unexpected outbound network connections originating from the n8n container or host.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect incoming XML payloads for malicious patterns, though patching remains the only reliable mitigation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe because it allows for full system compromise via Remote Code Execution. Administrators must treat this as an emergency update; ensure all instances of n8n are updated to the specified versions immediately to prevent unauthorized code execution.

Description Summary:
An authenticated user can inject CLI flags via the Git node's Push operation in n8n, enabling arbitrary file read access on the host server.

Executive Summary:
An authenticated command injection vulnerability in n8n allows attackers to read arbitrary files from the host server, potentially resulting in full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44790

Affected Software: n8n n8n

Affected Versions: Prior to 1.123.43, 2.22.1, and 2.20.7

Vulnerability: This is an authenticated command injection vulnerability where a user with permission to modify workflows can inject CLI flags into the Git node. By manipulating the Push operation, an attacker can bypass security controls to read sensitive files from the underlying n8n server.

Business Impact

The ability to read arbitrary files from the server represents a critical security failure, as it allows attackers to exfiltrate configuration files, secrets, or system credentials. With a CVSS score of 9.4, this vulnerability poses an extreme risk, potentially leading to a complete compromise of the workflow automation environment and all data processed therein.

Remediation Plan

Immediate Action: Upgrade n8n immediately to version 1.123.43, 2.22.1, or 2.20.7 to apply the necessary patches.

Proactive Monitoring: Review application and system logs for unexpected Git node activity or unusual CLI flag patterns originating from workflow operations.

Compensating Controls: Restrict permissions for creating or modifying workflows to trusted users only and implement strict network segmentation to limit the blast radius of a compromised node.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this arbitrary file read vulnerability, organizations must prioritize patching the n8n environment immediately. Restricting workflow creation privileges is a necessary secondary measure to ensure that only verified personnel can interact with potentially dangerous node operations until the update is applied.

Description Summary:
A prototype pollution vulnerability in n8n, exploitable via an unvalidated pagination parameter, can lead to remote code execution for authenticated users.

Executive Summary:
An authenticated remote code execution vulnerability exists in n8n due to insecure prototype pollution, requiring immediate updates to protected versions.

Vulnerability Details

CVE-ID: CVE-2026-44789

Affected Software: n8n-io n8n

Affected Versions: Prior to 1.123.43, 2.22.1, and 2.20.7

Vulnerability: The vulnerability exists in the HTTP Request node, where unvalidated pagination parameters allow an authenticated user with workflow modification permissions to perform global prototype pollution. This can be chained to achieve arbitrary remote code execution on the underlying host.

Business Impact

The CVSS score of 9.4 reflects the severity of achieving remote code execution. An attacker who has gained low-privileged access to the platform can escalate their privileges to take full control of the workflow automation instance, potentially accessing integrated services and sensitive data across the enterprise.

Remediation Plan

Immediate Action: Update n8n to version 1.123.43, 2.22.1, 2.20.7, or later to address the prototype pollution vector.

Proactive Monitoring: Monitor workflow modification logs for suspicious activity and review system execution logs for unexpected child processes or unusual shell commands.

Compensating Controls: Enforce strict role-based access control (RBAC) to limit which users can create or modify workflows until the patch can be applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for RCE makes this an urgent security concern for organizations utilizing automation workflows.

Analyst Recommendation

The severity of this flaw necessitates an immediate update to the latest patched versions. Security teams should prioritize patching this instance to prevent authenticated users from escalating their privileges and compromising the integrity of the automation platform.

Description Summary:
A SQL injection vulnerability exists in the n8n workflow automation platform prior to versions 1.123.32, 2.17.4, and 2.18.1.

Executive Summary:
An improper SQL neutralization vulnerability in the SeaTable node of n8n allows authenticated attackers to manipulate database queries and bypass row-level filtering.

Vulnerability Details

CVE-ID: CVE-2026-42229

Affected Software: n8n-io n8n

Affected Versions: < 1.123.32, >= 2.17.0, < 2.17.4, >= 2.18.0, < 2.18.1

Vulnerability: This is a SQL Injection vulnerability (CWE-89) affecting the SeaTable node's row:search and row:get operations. An authenticated user can inject unescaped input into SQL query strings, requiring low privileges and network access.

Business Impact

A successful exploitation of this vulnerability allows unauthorized users to retrieve unintended rows from connected SeaTable bases, potentially exposing sensitive data and violating row-level security controls. Although the CVSS score is 8.8 (High), the confidentiality and integrity impact on the surrounding context elevate the operational risk for organizations utilizing automated workflows with external inputs.

Remediation Plan

Immediate Action: Update the n8n software package to version 1.123.32, 2.17.4, 2.18.1, or later immediately.

Proactive Monitoring: Monitor workflow execution logs and database access patterns for unusual query structures or unexpected data retrieval volumes originating from automated nodes.

Compensating Controls: Implement input validation rules within workflows to sanitize external parameters before they are passed into SeaTable node search or row retrieval parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability relies on workflows that improperly handle untrusted external input passed into database operations.

Analyst Recommendation

Organizations utilizing the affected versions of n8n must prioritize upgrading to the patched releases to eliminate the risk of query manipulation. Reviewing existing workflow designs to ensure strict parameterization of user input will provide an essential layer of defense against similar injection vectors.

Description Summary:
A vulnerability in the n8n Merge node allows authenticated users to perform arbitrary file writes, potentially resulting in remote code execution on the server.

Executive Summary:
A critical vulnerability in the n8n workflow automation platform allows authenticated users to achieve remote code execution through arbitrary file writes.

Vulnerability Details

CVE-ID: CVE-2026-25056

Affected Software: n8n

Affected Versions: < 1.118.0 and < 2.4.0

Vulnerability: The vulnerability exists within the Merge node's SQL Query mode, where insufficient input validation permits authenticated users with workflow modification permissions to write arbitrary files to the server filesystem. This flaw, categorized under CWE-434 and CWE-693, facilitates remote code execution by bypassing intended security protections.

Business Impact

The ability to write arbitrary files to the host filesystem poses a severe risk to organizational infrastructure, as attackers can deploy malicious scripts or configuration files to gain full control over the n8n instance. With a CVSS score of 8.8, this vulnerability is considered High, as it enables complete system compromise, potential data exfiltration, and disruption of critical automated business workflows.

Remediation Plan

Immediate Action: Update the n8n instance to version 1.118.0 or 2.4.0 immediately to resolve the vulnerable file write capability.

Proactive Monitoring: Review workflow logs for unauthorized or suspicious SQL queries, particularly those interacting with the Merge node, and monitor filesystem integrity for unexpected file creation events.

Compensating Controls: Restrict permissions for creating or modifying workflows to trusted users only and implement strict network segmentation to limit the potential blast radius of a compromised automation server.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of February 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, it does require authenticated access to the platform to trigger the malicious file write, which serves as a primary barrier to entry for external attackers.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant threat to the security posture of the automation environment. Administrators must prioritize updating n8n to the patched versions specified above to prevent unauthorized filesystem access and maintain the integrity of automated processes.

Description Summary:
A path traversal vulnerability in the n8n SSH node allows unauthenticated attackers to write files to unintended locations on remote systems, potentially resulting in remote code execution.

Executive Summary:
A critical path traversal vulnerability in n8n allows unauthenticated remote attackers to execute arbitrary code on connected systems by manipulating file metadata.

Vulnerability Details

CVE-ID: CVE-2026-25055

Affected Software: n8n-io n8n

Affected Versions: < 1.123.12, < 2.4.0

Vulnerability: This is a path traversal flaw (CWE-22) occurring when the SSH node processes uploaded files without validating metadata. An unauthenticated attacker capable of accessing an exposed file upload endpoint can leverage this to write files to arbitrary directories on remote systems.

Business Impact

Successful exploitation grants an attacker the ability to overwrite critical system files or upload malicious scripts to remote servers, leading to full remote code execution. Given the CVSS score of 8.1, this vulnerability presents a significant risk to the integrity and availability of automated infrastructure, potentially allowing lateral movement within the network.

Remediation Plan

Immediate Action: Update n8n instances to version 1.123.12 or 2.4.0 immediately to apply the necessary metadata validation fixes.

Proactive Monitoring: Review web server and application logs for suspicious file upload patterns or requests targeting the SSH node endpoints.

Compensating Controls: Implement strict network ingress filtering to ensure that file upload endpoints are not exposed to the public internet unless absolutely necessary.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of February 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to have specific knowledge of existing workflows and access to an unauthenticated upload endpoint, which provides a degree of natural mitigation in hardened environments.

Analyst Recommendation

Organizations utilizing n8n for workflow automation must prioritize patching this vulnerability to prevent potential remote code execution. Due to the nature of the flaw, verify that all relevant instances are updated to the specified patched versions and perform an audit of current workflows to ensure no unauthorized SSH nodes are exposed to unauthenticated users.

Description Summary:
An authenticated remote code execution vulnerability exists in n8n workflow automation platform versions 0.121.2 and below.

Executive Summary:
An authenticated remote code execution vulnerability in n8n allows attackers to compromise both self-hosted and cloud instances, necessitating an immediate upgrade to version 1.121.3.

Vulnerability Details

CVE-ID: CVE-2026-21877

Affected Software: n8n

Affected Versions: 0.121.2 and below

Vulnerability: This vulnerability involves a critical flaw in the n8n workflow platform that allows an authenticated attacker to execute arbitrary code. The flaw impacts the service architecture, potentially leading to full system compromise.

Business Impact

The ability for an authenticated attacker to execute malicious code poses a severe risk to organizational data integrity and system availability. Given the CVSS score of 9.9, this vulnerability represents a near-total loss of control over the affected n8n instance. Successful exploitation could lead to data exfiltration, lateral movement within the network, and complete service disruption.

Remediation Plan

Immediate Action: Upgrade all n8n instances to version 1.121.3 or later immediately.

Proactive Monitoring: Review application access logs for unusual workflow executions or unauthorized modifications to automation configurations.

Compensating Controls: Disable the Git node functionality and restrict user access to trusted personnel only until the software can be patched.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical CVSS score, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a critical threat to the security of your workflow automation environment. Organizations should prioritize patching to version 1.121.3 as the primary mitigation strategy to prevent unauthorized code execution and potential system takeover.

Description Summary:
A file access vulnerability in n8n allows unauthenticated remote attackers to read files on the host server via specifically crafted form-based workflows.

Executive Summary:
The n8n workflow automation platform contains a critical vulnerability that allows unauthenticated remote attackers to access sensitive files on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-21858

Affected Software: n8n-io n8n

Affected Versions: >= 1.65.0, < 1.121.0

Vulnerability: This issue is an improper input validation flaw (CWE-20) where the application fails to properly sanitize inputs in form-based workflows, enabling unauthenticated attackers to perform unauthorized file system access.

Business Impact

The ability for an unauthenticated attacker to read arbitrary files on the server poses a severe risk of data exfiltration and credential theft. Given the CVSS score of 10.0, this vulnerability allows for total compromise of confidentiality and integrity, potentially leading to a full system takeover depending on the environment configuration.

Remediation Plan

Immediate Action: Update the n8n installation to version 1.121.0 or later immediately.

Proactive Monitoring: Review system access logs for unusual patterns or requests originating from external sources targeting form-based workflow endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious input patterns directed at workflow automation triggers.

Exploitation Status

Public Exploit Available: Yes — multiple public proof-of-concept repositories exist on GitHub.

Analyst Notes: As of Jan 8, 2026, there is no public information indicating active exploitation in the wild, though the presence of numerous public proof-of-concept repositories significantly elevates the risk of exploitation. The flaw is highly exploitable due to the lack of required authentication.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Organizations utilizing n8n must prioritize patching to version 1.121.0 to close the attack vector, as the availability of public proof-of-concept code makes the system highly susceptible to automated exploitation attempts.

Description Summary:
Authenticated users in n8n versions prior to 2.0.0 can exploit the Code node to access host filesystem resources, potentially leading to unauthorized file read and write operations.

Executive Summary:
A critical privilege management vulnerability in n8n allows authenticated workflow editors to perform unauthorized file system operations on the host, necessitating an immediate update to version 2.0.0.

Vulnerability Details

CVE-ID: CVE-2025-68697

Affected Software: n8n-io n8n

Affected Versions: < 2.0.0

Vulnerability: This vulnerability involves improper privilege management and the exposure of dangerous functions within the Code node, specifically when running in legacy JavaScript execution mode. Authenticated users with workflow editing permissions can invoke internal helper functions to interact with the host filesystem with the privileges of the n8n process.

Business Impact

Successful exploitation of this flaw allows an authenticated attacker to read or write files on the host server. Given a CVSS score of 7.1, this represents a high risk for organizations, as it can lead to the exposure of sensitive configuration data, credential theft, or the injection of malicious code into the host environment, ultimately compromising the integrity and confidentiality of the entire automation platform.

Remediation Plan

Immediate Action: Upgrade n8n to version 2.0.0 or later immediately to resolve the underlying privilege management issue.

Proactive Monitoring: Review audit logs for suspicious execution patterns within the Code node and monitor filesystem activity for unauthorized access attempts in sensitive directories.

Compensating Controls: If immediate patching is not feasible, restrict file access by configuring the N8N_RESTRICT_FILE_ACCESS_TO variable to a non-sensitive directory and consider disabling the Code node via the NODES_EXCLUDE environment variable.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 28, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to bridge the gap between workflow automation and host-level filesystem control.

Analyst Recommendation

The risk posed by CVE-2025-68697 is significant for any organization utilizing self-hosted n8n instances where workflow editors are not fully trusted. Administrators must treat this as a high-priority update, as the ability to manipulate the host filesystem provides a direct path for escalation and further system compromise. Please ensure that the update to version 2.0.0 is validated in a staging environment and deployed to production as soon as possible.

Description Summary:
A sandbox bypass in the n8n Python Code Node allows authenticated users to execute arbitrary commands on the host system with the privileges of the n8n process.

Executive Summary:
A critical sandbox escape vulnerability in the n8n workflow automation platform allows authenticated users to achieve arbitrary command execution on the underlying host.

Vulnerability Details

CVE-ID: CVE-2025-68668

Affected Software: n8n-io n8n

Affected Versions: >= 1.0.0, < 2.0.0

Vulnerability: This vulnerability is a protection mechanism failure (CWE-693) occurring within the Pyodide-based Python Code Node, which allows an authenticated user with workflow creation or modification privileges to escape the sandbox environment and execute arbitrary system commands.

Business Impact

The ability for an authenticated user to perform arbitrary command execution represents a critical security risk, as it effectively grants full control over the host system. Given the CVSS score of 9.9, this vulnerability poses a severe threat to data confidentiality, system integrity, and operational availability, potentially leading to total system compromise or lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade the n8n installation to version 2.0.0 or later to apply the official patch.

Proactive Monitoring: Audit workflow execution logs for unusual Python script activity or unauthorized attempts to access system-level environment variables and files.

Compensating Controls: If an immediate upgrade is not feasible, disable the Code Node by setting the environment variable NODES_EXCLUDE to ["n8n-nodes-base.code"] or disable Python support in the Code node by setting N8N_PYTHON_ENABLED=false.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of Dec 26, 2025, there is no confirmed active exploitation in the wild. However, because a public proof-of-concept exists, the risk of exploitation is considered elevated and credible. The vulnerability's impact is significant due to the direct path from workflow manipulation to host command execution.

Analyst Recommendation

Organizations utilizing n8n must prioritize upgrading to version 2.0.0 immediately to eliminate this sandbox escape vector. If immediate patching is operationally impossible, apply the recommended environment variable mitigations to disable the vulnerable Python Code Node functionality until the update can be deployed.

Description Summary:
n8n contains a critical remote code execution vulnerability in its workflow expression evaluation system, allowing authenticated attackers to execute arbitrary code with the privileges of the n8n process.

Executive Summary:
A critical remote code execution vulnerability in n8n is currently being actively exploited in the wild, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-68613

Affected Software: n8n

Affected Versions: >= 0.211.0, < 1.120.4, 1.121.0

Vulnerability: The vulnerability is an improper control of dynamically managed code resources (CWE-913) located within the workflow expression evaluation system. Authenticated users can supply expressions during workflow configuration that execute in an insufficiently isolated runtime environment, leading to remote code execution.

Business Impact

The CVSS score of 9.5 indicates a critical severity level, reflecting the potential for complete loss of confidentiality, integrity, and availability. Successful exploitation grants an attacker the ability to execute arbitrary system-level commands, which may result in the theft of sensitive workflow data, unauthorized access to connected services, and total compromise of the underlying host environment.

Remediation Plan

Immediate Action: Upgrade n8n to version 1.120.4, 1.121.1, or 1.122.0 immediately to apply the necessary security safeguards to the expression evaluation engine.

Proactive Monitoring: Review application and system logs for unusual workflow executions, unauthorized process spawning, or suspicious outbound network traffic originating from the n8n container or server.

Compensating Controls: If an immediate upgrade is not feasible, restrict workflow creation and editing permissions to only the most trusted users and ensure the instance is isolated within a hardened, low-privilege environment.

Exploitation Status

Public Exploit Available: Yes, a Metasploit module exists and multiple public proof of concept repositories are available on GitHub.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of March 10, 2026. The combination of high exploitability, active exploitation status, and the availability of weaponized exploit code makes this a top-priority remediation item.

Analyst Recommendation

Given the confirmed active exploitation and the critical nature of the remote code execution flaw, organizations must prioritize patching their n8n instances. Immediate application of the fixed versions is the only reliable method to mitigate this threat, as environmental mitigations provide only a temporary reduction in attack surface.

Description Summary:
A remote code execution vulnerability exists in the n8n Git Node component, where cloning a malicious repository allows arbitrary code execution via triggered pre-commit hooks.

Executive Summary:
A critical remote code execution vulnerability in n8n allows authenticated attackers to execute arbitrary code by manipulating Git repository pre-commit hooks.

Vulnerability Details

CVE-ID: CVE-2025-62726

Affected Software: n8n-io n8n

Affected Versions: < 1.113.0

Vulnerability: This is a remote code execution flaw (CWE-829) located in the Git Node component. An attacker with low privileges can trigger the execution of arbitrary code within the n8n environment by forcing the platform to commit from a malicious repository containing a pre-commit hook.

Business Impact

The ability to execute arbitrary code within the n8n automation platform presents a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized access to sensitive workflows, and the exfiltration of credentials stored within connected third-party services. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate attention to prevent lateral movement and data theft.

Remediation Plan

Immediate Action: Update n8n instances to version 1.113.0 or later immediately to incorporate the necessary security fixes in the Git Node component.

Proactive Monitoring: Review n8n server logs for unusual Git operations, unexpected process spawns originating from the n8n service account, or unauthorized repository connections.

Compensating Controls: Restrict n8n Git access to known, trusted repositories and implement network egress filtering to prevent the platform from reaching unauthorized external Git servers.

Exploitation Status

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

Analyst Notes: As of October 31, 2025, there is no confirmed active exploitation in the wild, but the availability of public proof-of-concept repositories significantly lowers the barrier for potential attackers. The vulnerability leverages the inherent trust placed in pre-commit hooks during the Git commit process, making it a highly effective vector for attackers who can influence repository content.

Analyst Recommendation

Given the potential for full system compromise and the presence of public proof-of-concept code, this vulnerability poses a significant risk to your environment. Administrators should prioritize the update to version 1.113.0 across all self-hosted and cloud-managed n8n instances. Failure to patch may allow attackers to gain persistent access to your automation workflows and integrated credentials.

Description Summary:
A vulnerability in the n8n open-source workflow automation platform could allow for unauthorized access or execution. The flaw affects the core automation engine and its handling of workflow data.

Executive Summary:
The n8n workflow automation platform contains a high-severity vulnerability that could permit an attacker to interfere with automated business processes and sensitive data integrations.

Vulnerability Details

CVE-ID: CVE-2025-61917

Affected Software: n8n n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The n8n platform, used for connecting various SaaS applications, suffers from a vulnerability in its workflow processing logic. While the specific authentication requirement is not explicitly stated, vulnerabilities in such platforms often involve the risk of unauthenticated attackers triggering workflows or accessing execution logs.

Business Impact

The impact of this vulnerability is significant due to n8n's role in handling sensitive API keys and cross-platform data. A CVSS score of 7.7 reflects a High severity risk where an exploit could lead to data exfiltration, unauthorized execution of business logic, and the compromise of connected third-party services, resulting in substantial operational and reputational damage.

Remediation Plan

Immediate Action: Update the n8n instance to the latest stable version immediately to address the underlying vulnerability in the workflow engine.

Proactive Monitoring: Audit execution logs for any unauthorized workflow triggers or anomalous data transfers to unknown external endpoints.

Compensating Controls: Deploy the n8n instance behind a VPN or use a Web Application Firewall (WAF) to restrict access to the management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Given the increasing popularity of low-code automation tools, this platform is a high-value target for attackers seeking to pivot into cloud environments.

Analyst Recommendation

Given the High severity and the critical nature of automation platforms in modern business operations, organizations must prioritize this patch. Failure to secure n8n instances could expose the entire interconnected software ecosystem of the enterprise to unauthorized access.

Description Summary:
A stored Cross-Site Scripting (XSS) vulnerability in the n8n Respond to Webhook node allows authenticated users to execute arbitrary JavaScript within the n8n editor interface.

Executive Summary:
An authenticated stored Cross-Site Scripting vulnerability in n8n allows malicious actors with workflow creation privileges to execute arbitrary JavaScript in the context of the editor interface.

Vulnerability Details

CVE-ID: CVE-2025-61914

Affected Software: n8n-io n8n

Affected Versions: < 1.114.0

Vulnerability: This vulnerability is a stored Cross-Site Scripting (XSS) flaw occurring when the Respond to Webhook node processes HTML content. An authenticated attacker with workflow creation permissions can bypass sandbox protections to execute malicious scripts in the top-level window of the n8n editor.

Business Impact

The ability to execute arbitrary JavaScript within the n8n editor interface poses a significant risk to organizational security. An attacker could potentially hijack administrative sessions, steal sensitive workflow data, or perform unauthorized actions on behalf of other users, leading to a compromise of the automation platform's integrity. With a CVSS score of 7.3, this high-severity vulnerability requires prompt attention to prevent unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Update the n8n platform to version 1.114.0 or later to apply the necessary security patches.

Proactive Monitoring: Review access logs for unusual activity related to workflow creation or webhook responses that contain unexpected HTML or script tags.

Compensating Controls: Restrict workflow creation and modification privileges to a small, trusted group of users and implement an external reverse proxy or HTML sanitizer to filter potentially malicious content from webhook responses.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 28, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for privilege escalation within the automation environment, though it requires the attacker to already hold workflow creation permissions.

Analyst Recommendation

Given the potential for unauthorized script execution within the n8n management interface, organizations must prioritize upgrading to version 1.114.0 immediately. By enforcing strict access controls and applying the vendor-supplied patch, administrators can effectively neutralize this cross-site scripting vector and protect their automation workflows from internal abuse.

Description Summary:
A stored Cross-Site Scripting (XSS) vulnerability in the n8n Form Trigger node allows authenticated attackers to execute arbitrary JavaScript, potentially leading to full account takeover.

Executive Summary:
A high-severity stored Cross-Site Scripting vulnerability in n8n allows authenticated attackers to execute malicious scripts and hijack user sessions, leading to potential account takeover.

Vulnerability Details

CVE-ID: CVE-2025-52478

Affected Software: n8n

Affected Versions: >= 1.77.0, < 1.98.2

Vulnerability: This is a stored Cross-Site Scripting (CWE-79) vulnerability located in the Form Trigger node. An authenticated attacker can inject malicious HTML or JavaScript via iframe or video tags, which executes when an authenticated user visits the crafted form.

Business Impact

The ability for an attacker to perform account takeover by exfiltrating session cookies and browser identifiers poses a severe risk to organizational data integrity and confidentiality. With a CVSS score of 8.7, this vulnerability is classified as High severity. Successful exploitation allows an attacker to impersonate legitimate users, modify account settings, and potentially gain full administrative control over the n8n workflow environment, particularly if multi-factor authentication is absent.

Remediation Plan

Immediate Action: Upgrade your n8n installation to version 1.98.2 or higher immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review application access logs for suspicious activity involving the Form Trigger node and monitor for anomalous session behavior or unexpected profile changes.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious iframe or video tag payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 20, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability requires an authenticated attacker, the potential impact of session hijacking and account takeover makes it a significant risk that should be addressed promptly.

Analyst Recommendation

Given the high CVSS score and the direct path to account takeover, organizations should prioritize patching this vulnerability. Administrators must verify their current n8n version and apply the update to 1.98.2 without delay. Failure to remediate could allow attackers to bypass security controls and compromise sensitive workflow data.