Full Report
n8n security advisory (AV26-916)
Analysis Summary
# Vulnerability: Multiple Security Flaws in n8n Workflow Automation
## CVE Details
- **CVE ID:** Not explicitly listed in the source advisory (Note: Advisory AV26-916 refers to a collection of fixes; historically these versions address issues such as Path Traversal or Improper Access Control).
- **CVSS Score:** N/A (Severity categorized as Critical/High per vendor release patterns).
- **CWE:** Commonly associated with CWE-22 (Path Traversal) or CWE-284 (Improper Access Control) in these specific release cycles.
## Affected Systems
- **Products:** n8n (Workflow Automation Platform)
- **Versions:**
- Versions prior to **2.37.7**
- Versions prior to **2.38.2**
- Versions prior to **1.123.76**
- **Configurations:** Default installations of the affected versions.
## Vulnerability Description
The advisory indicates that n8n versions prior to the identified releases are susceptible to security flaws that could compromise the integrity and confidentiality of the workflow automation server. Based on the release notes, these updates typically address vulnerabilities related to how the application handles file paths, user permissions, or credential storage within the self-hosted environment.
## Exploitation
- **Status:** Vulnerability documented; PoC status is currently undisclosed for this specific advisory, though n8n vulnerabilities are frequently targeted once patches are released.
- **Complexity:** Medium (Generally requires knowledge of n8n API or UI endpoints).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Potential exposure of environment variables and credentials).
- **Integrity:** High (Potential unauthorized modification of workflows).
- **Availability:** Medium (Potential for service disruption via exploitation).
## Remediation
### Patches
Users are strongly encouraged to update to the following versions or later:
- **n8n v2.37.7**
- **n8n v2.38.2**
- **n8n v1.123.76**
### Workarounds
- No specific workarounds are provided. Immediate patching is the recommended course of action.
- As a general best practice, ensure n8n instances are not exposed to the public internet without strong authentication (MFA) and are placed behind a VPN or firewall.
## Detection
- **Indicators of Compromise:** Monitor logs for unusual access to `/rest/` endpoints or unauthorized attempts to export workflow JSON files.
- **Detection methods and tools:** Audit n8n execution logs for unexpected "Execute Command" node activity or unauthorized credential access attempts.
## References
- **Vendor Advisories:**
- hxxps[://]github[.]com/n8n-io/n8n/security
- hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/n8n-security-advisory-av26-916
- **Relevant Links:**
- hxxps[://]github[.]com/n8n-io/n8n/releases/tag/[email protected]
- hxxps[://]github[.]com/n8n-io/n8n/releases/tag/[email protected]
- hxxps[://]github[.]com/n8n-io/n8n/releases/tag/[email protected]