AI Threat AlertCVE-2026-126384: n8n: bundled GraphicsMagick enables RCE via Edit Image
HIGHn8n's official Docker image ships a vulnerable GraphicsMagick build, and the Edit Image node uses it to process images. An attacker who can get a crafted image into an Edit Image workflow, for example one fed by a public Webhook node, can execute code on the n8n instance. This is rated high (CVSS 7.5) rather than critical because exploitation needs high attack complexity and low privileges. There is no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template yet, so active exploitation is not evidenced today. n8n usually holds credentials for many downstream systems, so a compromised instance can become a pivot point into the wider environment. Upgrade to 1.123.89, 2.45.5, 2.46.1 or 3.0.1 (or later), and until you can, disable or restrict Edit Image workflows that process untrusted input.
What is the risk?
High. The network vector, no user interaction and full C/I/A impact are offset by high attack complexity and a low-privilege requirement. Exposure depends on whether Edit Image workflows accept untrusted images, typically via public webhooks or form triggers. EPSS is unavailable, no public exploit or scanner template exists, and the CVE is not in KEV, so near-term mass exploitation is not confirmed. The weakness is classified as CWE-1395 (dependency on vulnerable third-party component). Compromise of n8n is high-value because it stores API keys, OAuth tokens and database credentials for connected AI and business systems.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 1.123.89, 2.45.5, 2.46.1, 3.0.1 or later and pull a refreshed official Docker image. 2) Until patched, disable or remove Edit Image nodes that process untrusted input, or put authentication and validation in front of the Webhook triggers feeding them. 3) Restrict image types and sizes before they reach the node. 4) Run n8n as a non-root user in a hardened container with minimal egress and no unnecessary secrets mounted. 5) Rotate credentials stored in n8n if any suspicious image-processing activity is found. 6) Detect: inventory workflows using Edit Image, review webhook logs for unusual image uploads, and monitor the container for unexpected child processes (for example gm spawning shells) and outbound connections. 7) Review the GHSA-f2cw-9483-7vcp advisory for details.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126384?
n8n's official Docker image ships a vulnerable GraphicsMagick build, and the Edit Image node uses it to process images. An attacker who can get a crafted image into an Edit Image workflow, for example one fed by a public Webhook node, can execute code on the n8n instance. This is rated high (CVSS 7.5) rather than critical because exploitation needs high attack complexity and low privileges. There is no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template yet, so active exploitation is not evidenced today. n8n usually holds credentials for many downstream systems, so a compromised instance can become a pivot point into the wider environment. Upgrade to 1.123.89, 2.45.5, 2.46.1 or 3.0.1 (or later), and until you can, disable or restrict Edit Image workflows that process untrusted input.
Is CVE-2026-126384 actively exploited?
No confirmed active exploitation of CVE-2026-126384 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126384?
1) Upgrade n8n to 1.123.89, 2.45.5, 2.46.1, 3.0.1 or later and pull a refreshed official Docker image. 2) Until patched, disable or remove Edit Image nodes that process untrusted input, or put authentication and validation in front of the Webhook triggers feeding them. 3) Restrict image types and sizes before they reach the node. 4) Run n8n as a non-root user in a hardened container with minimal egress and no unnecessary secrets mounted. 5) Rotate credentials stored in n8n if any suspicious image-processing activity is found. 6) Detect: inventory workflows using Edit Image, review webhook logs for unusual image uploads, and monitor the container for unexpected child processes (for example gm spawning shells) and outbound connections. 7) Review the GHSA-f2cw-9483-7vcp advisory for details.
What systems are affected by CVE-2026-126384?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, LLM orchestration platforms, containerized AI deployments.
What is the CVSS score for CVE-2026-126384?
CVE-2026-126384 has a CVSS v3.1 base score of 7.5 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0049Exploit Public-Facing ApplicationAML.T0083Credentials from AI Agent ConfigurationAML.T0112Machine CompromiseCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance.
Exploitation Scenario
An attacker identifies an internet-facing n8n webhook that feeds uploaded images into an Edit Image node, such as an AI-driven document or avatar processing workflow. They submit a crafted image that triggers a known GraphicsMagick vulnerability in the bundled library, achieving code execution inside the n8n container. From there they read environment variables and the credential store, steal LLM provider API keys and OAuth tokens, and pivot to connected databases, SaaS tools and internal APIs. They may also modify workflows to persist access or exfiltrate data.
Weaknesses (CWE)
CWE-1395 — Dependency on Vulnerable Third-Party Component: The product has a dependency on a third-party component that contains one or more known vulnerabilities.
- [Requirements, Policy] In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.
- [Requirements] Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n