CVE-2026-118648: n8n stored XSS — HIGH

CISO Take

CVE-2026-118648 is a stored cross-site scripting flaw in the n8n workflow automation platform: some webhook response paths (error responses and responses without headers) omit the sandbox Content-Security-Policy, so an authenticated member who can create and activate workflows can serve HTML that runs on the n8n origin in the session of anyone who opens the webhook URL. It is rated high (CVSS 7.3) with high confidentiality and integrity impact, and it matters because n8n instances typically hold stored credentials and API keys for LLMs, databases and SaaS systems, so a hijacked admin session can expose or alter every connected AI agent workflow. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, so exploitation is not currently observed, but the attack is low complexity and needs only a low-privileged account plus one click from a victim. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 (or later), and until then restrict workflow creation rights and avoid opening webhook URLs from untrusted members.

Sources:NVDGitHub AdvisoryATLASvulncheck.com

What is the risk?

Medium-high. Network-reachable, low complexity, low privileges and user interaction required (CVSS 7.3, scope unchanged, C:H/I:H/A:N). The attacker must already be an authenticated member with workflow create/activate rights, which limits exposure to multi-user or shared instances. Impact is high because script execution on the n8n origin acts with the victim's session, including admin sessions. No known active exploitation, no KEV listing, no public PoC and no EPSS data at the time of analysis (confidence: MEDIUM since EPSS and SSVC are unavailable).

How does the attack unfold?

Initial Access

Attacker uses a low-privileged member account to create and activate a workflow with a webhook.

AML.T0012

Payload Staging

The webhook returns malicious HTML via an error or header-less response path that lacks the sandbox CSP.

AML.T0049

Execution

A victim opens the webhook URL and the script runs on the n8n origin with their session.

AML.T0011.003

Impact

The script reads stored credentials and modifies workflows or agent configurations using the victim's privileges.

AML.T0083

Initial Access

Attacker uses a low-privileged member account to create and activate a workflow with a webhook.

AML.T0012

Payload Staging

The webhook returns malicious HTML via an error or header-less response path that lacks the sandbox CSP.

AML.T0049

Execution

A victim opens the webhook URL and the script runs on the n8n origin with their session.

AML.T0011.003

Impact

The script reads stored credentials and modifies workflows or agent configurations using the victim's privileges.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade to n8n 1.123.85 (1.x), 2.43.5 (2.43.x) or 2.44.1 (2.44.x) or later. 2) Until patched, limit who can create and activate workflows to trusted users and review the roles of existing members. 3) Audit active workflows with webhook triggers for ones that return HTML, custom response bodies or error paths, especially ones recently created by non-admin members. 4) Add a reverse-proxy rule that enforces a restrictive Content-Security-Policy (sandbox) on webhook paths, or serve webhooks from a separate origin from the editor UI. 5) Tell admins not to open unfamiliar webhook URLs while logged in to the editor. 6) Rotate credentials stored in n8n if suspicious webhook content or unexpected workflow changes are found. 7) Detect by reviewing workflow and webhook definitions for script tags or event handlers in response bodies, and by watching for unexpected credential or workflow modifications in audit logs.

How is it classified?

Code ExecutionData LeakageFrameworkAgentPluginAML.T0011.003- Malicious Link AML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-118648?

CVE-2026-118648 is a stored cross-site scripting flaw in the n8n workflow automation platform: some webhook response paths (error responses and responses without headers) omit the sandbox Content-Security-Policy, so an authenticated member who can create and activate workflows can serve HTML that runs on the n8n origin in the session of anyone who opens the webhook URL. It is rated high (CVSS 7.3) with high confidentiality and integrity impact, and it matters because n8n instances typically hold stored credentials and API keys for LLMs, databases and SaaS systems, so a hijacked admin session can expose or alter every connected AI agent workflow. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, so exploitation is not currently observed, but the attack is low complexity and needs only a low-privileged account plus one click from a victim. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 (or later), and until then restrict workflow creation rights and avoid opening webhook URLs from untrusted members.

Is CVE-2026-118648 actively exploited?

No confirmed active exploitation of CVE-2026-118648 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118648?

1) Upgrade to n8n 1.123.85 (1.x), 2.43.5 (2.43.x) or 2.44.1 (2.44.x) or later. 2) Until patched, limit who can create and activate workflows to trusted users and review the roles of existing members. 3) Audit active workflows with webhook triggers for ones that return HTML, custom response bodies or error paths, especially ones recently created by non-admin members. 4) Add a reverse-proxy rule that enforces a restrictive Content-Security-Policy (sandbox) on webhook paths, or serve webhooks from a separate origin from the editor UI. 5) Tell admins not to open unfamiliar webhook URLs while logged in to the editor. 6) Rotate credentials stored in n8n if suspicious webhook content or unexpected workflow changes are found. 7) Detect by reviewing workflow and webhook definitions for script tags or event handlers in response bodies, and by watching for unexpected credential or workflow modifications in audit logs.

What systems are affected by CVE-2026-118648?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, RAG pipelines, tool-calling integrations.

What is the CVSS score for CVE-2026-118648?

CVE-2026-118648 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM orchestration pipelinesRAG pipelinestool-calling integrations

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.

Exploitation Scenario

A low-privileged member of a shared n8n instance builds and activates a workflow with a webhook that returns attacker-controlled HTML through an error or header-less response path, so the sandbox CSP is missing. They send the webhook URL to an administrator, for example as a link to a status page or a supposedly failing AI agent workflow. When the admin opens it, the script runs on the n8n origin with the admin's session, calls the internal API to export credentials for LLM providers and connected systems, and adds a hidden workflow that forwards data to an attacker-controlled endpoint.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.