Critical n8n Vulnerability CVE-2026-25049 Allows Remote Command Execution

Critical n8n Flaw Enables Remote Command Execution via Workflow Exploitation

Security researchers have disclosed a critical vulnerability in the n8n workflow automation platform that could allow attackers to execute arbitrary system commands. The flaw, tracked as CVE-2026-25049 with a CVSS score of 9.4, stems from inadequate input sanitization, effectively bypassing safeguards implemented to mitigate a previous critical vulnerability, CVE-2025-68613 (CVSS 9.9).

Technical Details

The vulnerability arises from insufficient validation of user-supplied input within n8n workflows. Attackers can craft malicious workflows to inject and execute arbitrary system commands on vulnerable instances. This flaw circumvents security controls introduced to address CVE-2025-68613, a prior critical issue that also enabled remote code execution (RCE).

Key technical aspects include:

• Attack Vector: Exploitation via specially crafted workflows
• Impact: Unauthenticated remote command execution
• Affected Versions: All n8n versions prior to the patched release (specific version undisclosed)
• Mitigation Bypass: Evades fixes for CVE-2025-68613 due to incomplete sanitization

Impact Analysis

Successful exploitation of CVE-2026-25049 could lead to:

• Full system compromise of the n8n host
• Lateral movement within internal networks
• Data exfiltration or ransomware deployment
• Unauthorized access to sensitive workflows and integrated services

Given the high severity (CVSS 9.4) and the platform’s widespread use in DevOps and automation pipelines, organizations are urged to prioritize remediation.

Recommendations

Security teams should take the following steps immediately:

1. Apply Patches: Update n8n to the latest secure version (check n8n’s official security advisory for details).
2. Isolate Vulnerable Instances: Restrict network access to n8n deployments until patched.
3. Audit Workflows: Review all existing workflows for signs of tampering or malicious modifications.
4. Monitor for Exploitation: Deploy intrusion detection systems (IDS) to identify potential attack attempts.
5. Enforce Least Privilege: Limit n8n’s system permissions to reduce potential impact.

Background

n8n is an open-source workflow automation tool widely adopted for integrating APIs, databases, and third-party services. Its extensibility makes it a prime target for attackers seeking to compromise enterprise environments.

For further details, refer to the original disclosure by The Hacker News.