n8n: an exploited code-execution bug and a cvss 10 file-access flaw
Two critical n8n flaws — one needing only a login, one needing none if a vulnerable form workflow exists — could let attackers run code on, or read files from, n8n servers.
- cve
- CVE-2025-68613; CVE-2026-21858
- cvss
- CVE-2025-68613: 9.9 (v3.1, GitHub CNA), 8.8 (v3.1, NVD); CVE-2026-21858: 10.0 (v3.1, GitHub CNA)
- affected
- n8n 0.211.0 up to the fixed builds (CVE-2025-68613); 1.65.0 to before 1.121.0 (CVE-2026-21858)
- fixed in
- 1.120.4 / 1.121.1 / 1.122.0 (CVE-2025-68613); 1.121.0 (CVE-2026-21858)
- exploited
- yes — CVE-2025-68613 added to CISA KEV 2026-03-11
- platforms
- n8n open source workflow automation platform
what happened
- n8n published CVE-2025-68613 on 2025-12-19: expressions supplied by authenticated users during workflow configuration may be evaluated in a context not sufficiently isolated from the runtime, which an authenticated attacker could abuse to execute arbitrary code with the n8n process's privileges.[1,2]
- Versions from 0.211.0 are affected; fixes shipped in 1.120.4, 1.121.1 and 1.122.0.[2]
- GitHub, as CNA, scored CVE-2025-68613 9.9 under CVSS v3.1; NVD scored it 8.8.[2]
- n8n says successful exploitation could mean full instance compromise, including access to sensitive data and modified workflows.[1]
- CISA added CVE-2025-68613 to its KEV catalog on 2026-03-11 with a 2026-03-25 due date.[3,5]
- On 2026-01-07 n8n disclosed CVE-2026-21858 (CVSS 10.0, v3.1): certain form-based workflows could give an unauthenticated remote attacker access to files on the underlying server; versions from 1.65.0 up to but not including 1.121.0 are affected, and 1.121.0 fixes it.[4,6]
where sources differCVSS for CVE-2025-68613 differs: GitHub (CNA) 9.9 vs NVD 8.8, both v3.1. n8n's GitHub advisory names 1.122.0 as the patched release while the CVE record also lists 1.120.4 and 1.121.1.
sources6
- 01n8n Remote Code Execution via Expression Injection (GHSA-v98v-ff95-f3cp) ↗ primaryn8n via GitHub Security Advisoriesaccessed 2026-10-21
- 02NVD CVE API record for CVE-2025-68613 ↗ primaryNIST NVDaccessed 2026-10-21
- 03CISA Adds One Known Exploited Vulnerability to Catalog (2026-03-11) ↗ primaryCISAaccessed 2026-10-21
- 04Unauthenticated File Access via Improper Webhook Request Handling (GHSA-v4pr-fm98-w9pg) ↗ primaryn8n via GitHub Security Advisoriesaccessed 2026-10-21
- 05CISA Catalog of Known Exploited Vulnerabilities (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21
- 06NVD CVE API record for CVE-2026-21858 ↗ primaryNIST NVDaccessed 2026-10-21