Critical n8n Vulnerabilities CVE-2026-25049 Expose Servers to Remote Code Execution
- Securityish
- Threats & Incidents
Quick Summary
Multiple critical vulnerabilities in the n8n open-source workflow automation platform, tracked as CVE-2026-25049, allow authenticated users to execute arbitrary code on the server. These flaws stem from issues in n8n’s sanitization mechanism, bypassing a previous patch for CVE-2025-68613. Exploiting these vulnerabilities could lead to complete server compromise, including access to sensitive credentials and internal systems.
The Securityish Brief
Researchers have identified critical vulnerabilities in the n8n platform, collectively tracked as CVE-2026-25049. These flaws allow any authenticated user who can create or edit workflows to perform unrestricted remote code execution (RCE) on the n8n server. The vulnerabilities arise from weaknesses in n8n’s sanitization mechanism, which failed to adequately protect against code execution, even after a patch was implemented for CVE-2025-68613 on December 20, 2025.
Pillar Security reported that exploiting CVE-2026-25049 could lead to a complete compromise of the n8n instance, enabling attackers to run arbitrary system commands, steal stored credentials, and access sensitive configuration files. The vulnerabilities also allow attackers to pivot to connected cloud accounts and hijack AI workflows, which could have significant implications for users relying on n8n for automation.
The n8n team confirmed the bypass of the initial fix on December 30, 2025, and subsequently released version 2.4.0 on January 12, 2026, to address the issue. However, researchers from Endor Labs demonstrated that the sanitization function was flawed, leading to a type-confusion vulnerability that allowed for arbitrary code execution. SecureLayer7 also provided a proof-of-concept exploit that detailed how to achieve server-side JavaScript execution.
Implications for Users and Organizations
As n8n continues to gain popularity, the attention from cybercriminals raises concerns about the security of automated workflows. Currently, there are no public reports of CVE-2026-25049 being exploited, but the potential for exploitation is significant. Users should be vigilant, especially given that GreyNoise reported over 33,000 requests targeting exposed n8n endpoints.
Organizations using n8n should prioritize updating to the latest versions (1.123.17 and 2.5.2) to mitigate risks. Additionally, it is advisable to rotate the ‘N8N_ENCRYPTION_KEY’ and review workflows for any suspicious expressions. If immediate updates are not feasible, limiting workflow creation permissions to trusted users and deploying n8n in a hardened environment can help reduce potential impacts.
Key Takeaways
- Update n8n to the latest version (1.123.17 or 2.5.2) to mitigate vulnerabilities.
- Rotate the ‘N8N_ENCRYPTION_KEY’ and all stored credentials on the server.
- Review workflows for suspicious expressions that could exploit vulnerabilities.
- Limit workflow creation and editing permissions to fully trusted users only.
- Deploy n8n in a hardened environment with restricted OS privileges and network access.
Key Terms & Concepts
- CVE-2026-25049: In this article, CVE-2026-25049 refers to a set of critical vulnerabilities in the n8n platform that allow remote code execution.
- Remote Code Execution (RCE): RCE is a type of vulnerability that allows an attacker to execute arbitrary commands on a remote server.
- n8n: n8n is an open-source workflow automation platform that enables users to automate tasks and connect various services.
- Pillar Security: Pillar Security is a cybersecurity company that reported on the vulnerabilities found in the n8n platform.
- Endor Labs: Endor Labs is a cybersecurity research firm that demonstrated the vulnerabilities in n8n and provided proof-of-concept exploits.
Read the original article here: https://www.bleepingcomputer.com/news/security/critical-n8n-flaws-disclosed-along-with-public-exploits/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
