n8n Faces Critical Security Vulnerability
A severe remote code execution (RCE) vulnerability has been discovered in n8n, a widely-used workflow automation platform. This security flaw enables authenticated users to run arbitrary system commands on the server through crafted workflows.
The issue marks a significant regression from the previously identified vulnerability CVE-2025-68613, underscoring ongoing risks within n8n’s expression evaluation engine.
Understanding the Core Vulnerability
The vulnerability stems from the manner in which n8n handles dynamic expressions within its workflow nodes. Typically, users employ these expressions to transfer data between workflow steps smoothly.
However, if an authenticated user has the ability to create or modify workflows, they can inject harmful payloads into these expressions. By doing so, the attacker can circumvent input sanitization and execute system-level commands, bypassing the intended sandbox environment.
Risks and Potential Impact
This exploitation method poses a significant threat, particularly to self-hosted instances operating under default configurations with extensive permissions. Once a malicious workflow is triggered, either manually or automatically, the embedded code runs with the same privileges as the n8n process.
Successful attacks could lead to the full compromise of the host server, allow lateral movement into connected networks, and result in the theft of sensitive API keys and other credentials stored within the n8n credential management system.
Mitigation Measures and Recommendations
To address this critical flaw, n8n’s maintainers have issued emergency patches. Organizations using older versions must upgrade immediately to benefit from stricter validation processes that prevent shell command execution within workflow expressions.
For those unable to upgrade promptly, applying defense-in-depth strategies is essential to mitigate risks. While these measures cannot completely eliminate the threat, they can significantly hinder exploitation attempts.
Security teams should proactively scan their environments for outdated n8n installations and vigilantly monitor for unusual process activities originating from the n8n service daemon.
Stay informed with our daily cybersecurity updates by following us on Google News, LinkedIn, and X. Contact us for exclusive story features.
