Full Report
n8n security advisory (AV26-880)
Analysis Summary
# Vulnerability: Multiple Flaws in n8n Workflow Automation
## CVE Details
* **CVE ID:** Not explicitly listed in the summary (Refer to GitHub Security Advisory link for specific IDs)
* **CVSS Score:** N/A (Severity categorized as High/Critical based on advisory context)
* **CWE:** N/A
## Affected Systems
* **Products:** n8n (Workflow Automation Tool)
* **Versions:**
* Prior to 1.123.76
* Prior to 2.35.4
* Prior to 2.36.2
* Prior to 2.37.7
* Prior to 2.38.2
* **Configurations:** Standard installations of the affected versions.
## Vulnerability Description
While the specific technical vectors (e.g., RCE, XSS, or Auth Bypass) are detailed within the internal n8n security advisories, these vulnerabilities generally involve flaws in the processing of workflow data or API interactions that could allow an attacker to compromise the n8n instance.
## Exploitation
* **Status:** Not reported as exploited in the wild (Information based on standard advisory release).
* **Complexity:** Dependent on specific CVE; typically Low to Medium for web-based automation tools.
* **Attack Vector:** Network (Remote)
## Impact
* **Confidentiality:** High (Potential access to sensitive credentials stored in n8n)
* **Integrity:** High (Potential unauthorized modification of automated workflows)
* **Availability:** High (Potential for service disruption)
## Remediation
### Patches
Users and administrators are strongly encouraged to upgrade to the following versions or later:
* **n8n v1.123.76**
* **n8n v2.35.4**
* **n8n v2.36.2**
* **n8n v2.37.7**
* **n8n v2.38.2**
### Workarounds
* Ensure the n8n instance is not exposed to the public internet without a VPN or strict IP whitelisting.
* Implement strong authentication/SSO for all users accessing the n8n dashboard.
## Detection
* **Indicators of Compromise:** Monitor for unusual administrative activity, unauthorized creation of new workflows, or unexpected outbound network traffic from the n8n host.
* **Detection methods and tools:** Audit n8n server logs for suspicious API requests or unauthorized login attempts.
## References
* Canadian Centre for Cyber Security (AV26-880): hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/n8n-security-advisory-av26-880
* n8n GitHub Security Advisories: hxxps[://]github[.]com/n8n-io/n8n/security