AI Threat Alert
CVE-2026-25053
CRITICALn8n is widely deployed as an AI agent orchestration platform and this 9.9 CVE gives any authenticated user—including low-privilege accounts—arbitrary OS command execution and file read on the host. Patch immediately to 1.123.10 or 2.5.0; treat all API keys, AI service credentials, and secrets stored on any n8n host as potentially compromised. If patching is not immediately possible, restrict workflow creation and modification to trusted administrators only.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
| n8n | npm | — | No patch |
Severity & Risk
Recommended Action
- 1. PATCH IMMEDIATELY: Upgrade to n8n 1.123.10 (v1 branch) or 2.5.0 (v2 branch)—no workaround substitutes for patching. 2. ROTATE ALL CREDENTIALS: Assume any secret accessible from the n8n host (AI API keys, DB passwords, SSH keys, Stripe/webhook secrets, .env vars) is compromised if patch was delayed. 3. RESTRICT PERMISSIONS: Limit workflow create/modify rights to trusted admins until patched. 4. NETWORK ISOLATION: Ensure n8n is not publicly exposed; place behind VPN or strict IP allowlist. 5. AUDIT LOGS: Review workflow creation and modification events for unauthorized or suspicious Git node usage in the period before patching. 6. HARDEN CONTAINER: Run n8n with minimal host filesystem access, read-only mounts, and dropped capabilities. 7. DETECTION: Alert on unexpected outbound connections from the n8n host and anomalous child process spawning (e.g., bash, sh, curl spawned by the n8n process).
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. This issue has been patched in versions 1.123.10 and 2.5.0.
Exploitation Scenario
An attacker compromises or registers a low-privilege n8n account via credential stuffing, phishing, or abuse of self-registration. They create a workflow using the Git node with crafted parameters that inject OS commands—for example, reading /proc/self/environ to dump environment variables containing OPENAI_API_KEY, ANTHROPIC_API_KEY, database connection strings, and Stripe webhook secrets. With full command execution, they deploy a reverse shell, exfiltrate the entire n8n workflow database (containing all automation logic and embedded credentials), and use stolen AI API keys to pivot into LLM providers and downstream AI services. In AI-heavy deployments the attacker gains access to RAG database credentials, vector store API keys, and all integrated AI service configurations with zero forensic footprint in the AI provider logs.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H