AI Threat Alert
CVE-2026-25052
CRITICALIf your organization runs n8n for AI workflow automation or agent orchestration, patch immediately to v1.123.18 or v2.5.0 — this is a 'patch today, not patch Tuesday' situation. Any authenticated user with workflow create/modify permissions can read arbitrary host files, harvesting every API key, database credential, and secret stored on that system. Assume all credentials on unpatched instances are compromised and rotate them now.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
| n8n | npm | — | No patch |
Severity & Risk
Recommended Action
- 1. PATCH: Upgrade to n8n 1.123.18 or 2.5.0 immediately — no workaround substitutes the patch. 2. ROTATE: Assume all credentials stored in the n8n instance (LLM API keys, DB passwords, OAuth tokens, webhook secrets) are compromised — rotate all of them, even if no exploitation is confirmed. 3. AUDIT: Review n8n instance logs for unusual workflow activity accessing unexpected file paths prior to patching. 4. RESTRICT: Treat workflow create/modify permissions as admin-equivalent until patched; revoke from all non-essential users immediately. 5. ISOLATE: Run n8n in a container with a read-only root filesystem and bind-mount only required directories; use external secrets management (Vault, AWS Secrets Manager) instead of .env files. 6. DETECT: Alert on workflows containing file read operations accessing sensitive paths (/etc, /root, ~/.ssh, /app/config, any .env pattern).
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of any user on the instance. This issue has been patched in versions 1.123.18 and 2.5.0.
Exploitation Scenario
An adversary obtains a low-privilege n8n account (via phishing, credential stuffing, or an insider) on an instance orchestrating AI agent workflows. They create a new workflow containing a Function node that abuses the file access vulnerability to read /home/n8n/.env and n8n's database config — extracting OpenAI/Anthropic API keys, PostgreSQL connection strings, and n8n admin credentials in a single workflow execution. With admin credentials, they achieve full instance takeover, gain visibility into all existing AI agent workflows (including any sensitive data processed by them), and silently modify workflows to exfiltrate future inputs. The harvested LLM API keys are then used for cost harvesting or to pivot into the broader AI infrastructure. The full attack requires no technical sophistication beyond basic n8n workflow knowledge.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H