AI Threat AlertCVE-2026-126387: n8n: arbitrary file read via Browser Use upload tool
MEDIUMn8n before 2.46.1 lets an authenticated member read arbitrary server files, such as instance configuration, by passing absolute paths to the Browser Use browser_upload tool, which makes Playwright read the file and expose its contents through the page. Exploitation requires a valid low-privilege account and a connected remote browser session, and the CVSS vector rates complexity as high, so the medium 5.3 score is reasonable. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no sign of active exploitation today. The risk is concentrated in multi-user n8n instances, because the instance configuration typically holds the encryption key that protects stored credentials, so a read could lead to wider compromise of connected systems. Upgrade to n8n 2.46.1 or later, and until then limit member access, disable the Browser Use feature where it is not needed, and review who can connect remote browser sessions.
What is the risk?
Medium overall. CVSS 3.1 is 5.3 (AV:N/AC:H/PR:L/UI:N), with high confidentiality impact and no integrity or availability impact. The attacker needs an authenticated member account and a connected remote browser session, which narrows exposure. No public exploit, Nuclei template, KEV listing or EPSS score is available, so near-term exploitation likelihood looks low. The real impact depends on what the n8n server holds: instance configuration and possibly the credential encryption key raise the severity in practice for shared or multi-tenant deployments.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Browser Use | pip | — | No patch |
| n8n | npm | — | No patch |
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade n8n to 2.46.1 or later.
Until patched, restrict member accounts to trusted users and disable or restrict the Browser Use node/tool and remote browser connections.
Rotate the n8n encryption key, stored credentials and API keys if untrusted members had access to affected versions.
Run n8n with a least-privilege OS user and a container with a minimal filesystem and read-only mounts for sensitive paths.
Detect: review workflow executions and audit logs for browser_upload calls with absolute paths (for example /home/node/.n8n/config or /etc/*), and monitor for unusual remote browser sessions.
Review the vendor advisory GHSA-9qx8-fhxv-w794 for further guidance.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126387?
n8n before 2.46.1 lets an authenticated member read arbitrary server files, such as instance configuration, by passing absolute paths to the Browser Use browser_upload tool, which makes Playwright read the file and expose its contents through the page. Exploitation requires a valid low-privilege account and a connected remote browser session, and the CVSS vector rates complexity as high, so the medium 5.3 score is reasonable. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no sign of active exploitation today. The risk is concentrated in multi-user n8n instances, because the instance configuration typically holds the encryption key that protects stored credentials, so a read could lead to wider compromise of connected systems. Upgrade to n8n 2.46.1 or later, and until then limit member access, disable the Browser Use feature where it is not needed, and review who can connect remote browser sessions.
Is CVE-2026-126387 actively exploited?
No confirmed active exploitation of CVE-2026-126387 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126387?
1. Upgrade n8n to 2.46.1 or later. 2. Until patched, restrict member accounts to trusted users and disable or restrict the Browser Use node/tool and remote browser connections. 3. Rotate the n8n encryption key, stored credentials and API keys if untrusted members had access to affected versions. 4. Run n8n with a least-privilege OS user and a container with a minimal filesystem and read-only mounts for sensitive paths. 5. Detect: review workflow executions and audit logs for browser_upload calls with absolute paths (for example /home/node/.n8n/config or /etc/*), and monitor for unusual remote browser sessions. 6. Review the vendor advisory GHSA-9qx8-fhxv-w794 for further guidance.
What systems are affected by CVE-2026-126387?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, browser-automation agents, multi-user AI orchestration.
What is the CVSS score for CVE-2026-126387?
CVE-2026-126387 has a CVSS v3.1 base score of 5.3 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037Data from Local SystemAML.T0053AI Agent Tool InvocationAML.T0083Credentials from AI Agent ConfigurationAML.T0085.001AI Agent ToolsCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page.
Exploitation Scenario
An attacker with a low-privilege member account on a shared n8n instance builds a workflow that uses the Browser Use agent and connects a remote browser session under their control. They invoke the browser_upload tool with an absolute path such as the n8n instance configuration file. Playwright on the n8n server reads the file and attaches it to the page, and the attacker retrieves its contents from the page. With the encryption key obtained, they can decrypt stored credentials and pivot to connected LLM providers, databases and SaaS accounts.
Weaknesses (CWE)
CWE-36 — Absolute Path Traversal: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n