CVE-2025-71380: n8n authenticated RCE

CISO Take

The Execute Command node in n8n lets any authenticated user run arbitrary OS commands on the host running the automation platform, effectively turning a built-in workflow feature into an unrestricted shell. There is no CISA KEV listing, no public exploit, and no Nuclei template yet, but the CVSS 8.8 score reflects that exploitation needs only low privileges and zero user interaction — trivial for any low-privileged or compromised n8n account to trigger. Because n8n is widely used to orchestrate AI agent workflows and stores API keys and other secrets in its credential vault, a compromised low-priv account can pivot straight into LLM provider keys, connected SaaS tools, and the underlying host. This is a privilege-boundary failure rather than an unauthenticated remote-exploit emergency: patch to the version referenced in GHSA-365g-vjw2-grx8, restrict who can create or edit workflows containing the Execute Command node, and audit existing workflows and shell history for suspicious command usage.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity (CVSS 8.8) driven by full confidentiality/integrity/availability impact and low attack complexity, but real-world risk is currently moderated by the authentication requirement (PR:L) and the absence of EPSS data, CISA KEV listing, public exploit code, or a Nuclei scanner template — there is no evidence of active or automated mass exploitation today. The realistic threat model is an insider, a low-privileged workflow author, or an attacker who has already obtained valid n8n credentials via phishing or credential stuffing; for that actor, exploitation is trivial and immediate (no sandboxing or command filtering to bypass). Because n8n is frequently deployed as the orchestration layer for AI agent and integration pipelines with broad credential access, the blast radius of a successful exploitation is disproportionately large relative to the low bar for triggering it.

How does the attack unfold?

Initial Access

Attacker obtains or already holds valid low-privileged n8n user credentials via phishing, credential stuffing, or insider access.

AML.T0012

Tool Abuse

Attacker creates or edits a workflow adding an Execute Command node with an arbitrary shell payload.

AML.T0053

Command Execution

Workflow is triggered manually or via webhook, executing the attacker's command with the privileges of the n8n host process.

AML.T0050

Impact

Attacker exfiltrates credentials from the n8n vault (including LLM API keys) or disrupts automation pipelines, achieving full host compromise.

AML.T0112

Initial Access

Attacker obtains or already holds valid low-privileged n8n user credentials via phishing, credential stuffing, or insider access.

AML.T0012

Tool Abuse

Attacker creates or edits a workflow adding an Execute Command node with an arbitrary shell payload.

AML.T0053

Command Execution

Workflow is triggered manually or via webhook, executing the attacker's command with the privileges of the n8n host process.

AML.T0050

Impact

Attacker exfiltrates credentials from the n8n vault (including LLM API keys) or disrupts automation pipelines, achieving full host compromise.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
201.9K OpenSSF 6.7 Pushed 3d ago 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade n8n to the version that remediates GHSA-365g-vjw2-grx8 as soon as it is available/validated in your environment. Until patched, restrict or disable the Execute Command node via the NODES_EXCLUDE environment variable if it is not required by existing workflows, and tighten role-based access so only trusted administrators can author or edit workflows. Rotate credentials stored in the n8n credential vault (LLM API keys, DB creds, SaaS tokens) as a precaution, enforce MFA and strong password policies on all n8n user accounts to reduce the chance of low-priv account compromise, and enable host-level process/command auditing (e.g., auditd, EDR) to detect anomalous child processes spawned by the n8n service account.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security controls

NIST AI RMF

MANAGE 4.1 - AI system risks and benefits are monitored and managed

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-71380?

The Execute Command node in n8n lets any authenticated user run arbitrary OS commands on the host running the automation platform, effectively turning a built-in workflow feature into an unrestricted shell. There is no CISA KEV listing, no public exploit, and no Nuclei template yet, but the CVSS 8.8 score reflects that exploitation needs only low privileges and zero user interaction — trivial for any low-privileged or compromised n8n account to trigger. Because n8n is widely used to orchestrate AI agent workflows and stores API keys and other secrets in its credential vault, a compromised low-priv account can pivot straight into LLM provider keys, connected SaaS tools, and the underlying host. This is a privilege-boundary failure rather than an unauthenticated remote-exploit emergency: patch to the version referenced in GHSA-365g-vjw2-grx8, restrict who can create or edit workflows containing the Execute Command node, and audit existing workflows and shell history for suspicious command usage.

Is CVE-2025-71380 actively exploited?

No confirmed active exploitation of CVE-2025-71380 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71380?

Upgrade n8n to the version that remediates GHSA-365g-vjw2-grx8 as soon as it is available/validated in your environment. Until patched, restrict or disable the Execute Command node via the `NODES_EXCLUDE` environment variable if it is not required by existing workflows, and tighten role-based access so only trusted administrators can author or edit workflows. Rotate credentials stored in the n8n credential vault (LLM API keys, DB creds, SaaS tokens) as a precaution, enforce MFA and strong password policies on all n8n user accounts to reduce the chance of low-priv account compromise, and enable host-level process/command auditing (e.g., auditd, EDR) to detect anomalous child processes spawned by the n8n service account.

What systems are affected by CVE-2025-71380?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow/automation orchestration, plugin/tool integrations.

What is the CVSS score for CVE-2025-71380?

CVE-2025-71380 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.57%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow/automation orchestrationplugin/tool integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

Exploitation Scenario

An attacker obtains valid credentials for a low-privileged n8n user — via phishing, credential stuffing, or an insider with limited workflow-editor access. They create or modify a workflow that includes an Execute Command node, embedding a command such as a reverse shell payload or a script that dumps the n8n credential store, then trigger the workflow manually or via an existing webhook trip. The command executes with the privileges of the n8n host process, giving the attacker a foothold on the underlying server; from there they harvest stored LLM API keys and other integration secrets, move laterally to connected systems, or disrupt the automation pipelines that AI agent workflows depend on.

Weaknesses (CWE)

CWE-284 Improper Access Control Primary CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.