AI Threat AlertCVE-2026-110849: n8n: stored XSS in file preview enables session hijack
UNKNOWNn8n, the workflow automation platform widely used to orchestrate AI agents, has a stored cross-site scripting flaw in its file-preview modal, which re-publishes uploaded binary data as an unsandboxed same-origin blob URL. A low-privileged member can upload a crafted item, and when the owner or an admin previews it, the attacker's script runs in the n8n origin with that user's session. That can lead to workflow tampering and theft of the credentials n8n stores, including LLM API keys and connected SaaS tokens. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so exploitation likelihood looks low for now. It does need an authenticated member account and a victim who previews the file, which limits mass exploitation. Upgrade to n8n 1.123.83, 2.41.4 or 2.42.1 or later, and until then restrict member upload permissions and tell owners not to preview untrusted files.
What is the risk?
Medium risk. No CVSS score has been published, so this is an estimate. The attack needs an authenticated member account and one user interaction (previewing the file). The XSS runs in the full n8n origin, so the impact on confidentiality, integrity and availability within the victim's session can be high, especially when the victim is the instance owner. There is no evidence of active exploitation, no public exploit, and no KEV or SSVC signal. Exposure is highest in multi-user n8n instances where untrusted or semi-trusted members can upload data.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step1) Upgrade to n8n 1.123.83, 2.41.4, 2.42.1 or later. 2) Until patched, limit who can hold member accounts and who can upload files or binary data, and tell owners and admins not to preview files from untrusted members. 3) Enforce a strict Content-Security-Policy and host n8n on a dedicated origin where practical. 4) Rotate credentials stored in n8n if you suspect an owner session was exposed. 5) Review workflow and credential change history, audit logs and recent member-uploaded binary items for HTML or script content. 6) Monitor for unexpected workflow edits, new webhook triggers or unusual outbound requests from the n8n host.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-110849?
n8n, the workflow automation platform widely used to orchestrate AI agents, has a stored cross-site scripting flaw in its file-preview modal, which re-publishes uploaded binary data as an unsandboxed same-origin blob URL. A low-privileged member can upload a crafted item, and when the owner or an admin previews it, the attacker's script runs in the n8n origin with that user's session. That can lead to workflow tampering and theft of the credentials n8n stores, including LLM API keys and connected SaaS tokens. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so exploitation likelihood looks low for now. It does need an authenticated member account and a victim who previews the file, which limits mass exploitation. Upgrade to n8n 1.123.83, 2.41.4 or 2.42.1 or later, and until then restrict member upload permissions and tell owners not to preview untrusted files.
Is CVE-2026-110849 actively exploited?
No confirmed active exploitation of CVE-2026-110849 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-110849?
1) Upgrade to n8n 1.123.83, 2.41.4, 2.42.1 or later. 2) Until patched, limit who can hold member accounts and who can upload files or binary data, and tell owners and admins not to preview files from untrusted members. 3) Enforce a strict Content-Security-Policy and host n8n on a dedicated origin where practical. 4) Rotate credentials stored in n8n if you suspect an owner session was exposed. 5) Review workflow and credential change history, audit logs and recent member-uploaded binary items for HTML or script content. 6) Monitor for unexpected workflow edits, new webhook triggers or unusual outbound requests from the n8n host.
What systems are affected by CVE-2026-110849?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, multi-user AI automation platforms.
What is the CVSS score for CVE-2026-110849?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0081Modify AI Agent ConfigurationAML.T0083Credentials from AI Agent ConfigurationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.
Exploitation Scenario
A malicious or compromised member account uploads a crafted item, such as an HTML or SVG file containing JavaScript, into a workflow's binary data. When the instance owner opens the file-preview modal, n8n serves the content as a same-origin blob URL without a sandbox and the script runs with the owner's session. The script calls the n8n API to read credential metadata, create a workflow that exfiltrates API keys to an attacker server, or change an existing AI agent workflow to add a malicious tool. The attacker then has persistent access to connected systems.
Weaknesses (CWE)
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')PrimaryCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n