CVE-2026-25052: n8n security flaw enables

CISO Take

If your organization runs n8n for AI workflow automation or agent orchestration, patch immediately to v1.123.18 or v2.5.0 — this is a 'patch today, not patch Tuesday' situation. Any authenticated user with workflow create/modify permissions can read arbitrary host files, harvesting every API key, database credential, and secret stored on that system. Assume all credentials on unpatched instances are compromised and rotate them now.

What is the risk?

Extremely high risk. CVSS 9.9 with scope change (S:C) reflects that exploitation extends well beyond n8n itself to every connected system. Attack complexity is low, only a low-privilege account is needed, and no user interaction is required — meaning any insider, phished account, or credential-stuffed login immediately translates to full host-level credential harvest. n8n is widely deployed as an AI agent orchestration layer storing LLM API keys, database passwords, and OAuth tokens, making it a premium target: one exploited instance can compromise the organization's entire AI infrastructure stack.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
193.4K OpenSSF 6.6 Pushed 2d ago 55% patched ~7d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

6 steps

PATCH

Upgrade to n8n 1.123.18 or 2.5.0 immediately — no workaround substitutes the patch.
ROTATE

Assume all credentials stored in the n8n instance (LLM API keys, DB passwords, OAuth tokens, webhook secrets) are compromised — rotate all of them, even if no exploitation is confirmed.
AUDIT

Review n8n instance logs for unusual workflow activity accessing unexpected file paths prior to patching.
RESTRICT

Treat workflow create/modify permissions as admin-equivalent until patched; revoke from all non-essential users immediately.
ISOLATE

Run n8n in a container with a read-only root filesystem and bind-mount only required directories; use external secrets management (Vault, AWS Secrets Manager) instead of .env files.
DETECT

Alert on workflows containing file read operations accessing sensitive paths (/etc, /root, ~/.ssh, /app/config, any .env pattern).

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Data Leakage Agent Framework API AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.1.2 - Segregation of Duties in AI Systems A.6.2 - AI system access control A.9.3 - Protection of AI system resources

NIST AI RMF

GOVERN 6.1 - Risk and privacy policy for third-party AI components MANAGE 2.2 - Mechanisms to sustain the value of deployed AI with regular updates MANAGE 2.4 - Mechanisms for AI Risk Treatment

OWASP LLM Top 10

LLM06:2025 - Excessive Agency LLM08:2025 - Excessive Permissions

Frequently Asked Questions

What is CVE-2026-25052?

If your organization runs n8n for AI workflow automation or agent orchestration, patch immediately to v1.123.18 or v2.5.0 — this is a 'patch today, not patch Tuesday' situation. Any authenticated user with workflow create/modify permissions can read arbitrary host files, harvesting every API key, database credential, and secret stored on that system. Assume all credentials on unpatched instances are compromised and rotate them now.

Is CVE-2026-25052 actively exploited?

No confirmed active exploitation of CVE-2026-25052 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-25052?

1. PATCH: Upgrade to n8n 1.123.18 or 2.5.0 immediately — no workaround substitutes the patch. 2. ROTATE: Assume all credentials stored in the n8n instance (LLM API keys, DB passwords, OAuth tokens, webhook secrets) are compromised — rotate all of them, even if no exploitation is confirmed. 3. AUDIT: Review n8n instance logs for unusual workflow activity accessing unexpected file paths prior to patching. 4. RESTRICT: Treat workflow create/modify permissions as admin-equivalent until patched; revoke from all non-essential users immediately. 5. ISOLATE: Run n8n in a container with a read-only root filesystem and bind-mount only required directories; use external secrets management (Vault, AWS Secrets Manager) instead of .env files. 6. DETECT: Alert on workflows containing file read operations accessing sensitive paths (/etc, /root, ~/.ssh, /app/config, any .env pattern).

What systems are affected by CVE-2026-25052?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Workflow automation pipelines, Multi-agent orchestration systems, LLM API integration hubs, No-code/low-code AI platforms.

What is the CVSS score for CVE-2026-25052?

CVE-2026-25052 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksWorkflow automation pipelinesMulti-agent orchestration systemsLLM API integration hubsNo-code/low-code AI platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.1.2, A.6.2, A.9.3

NIST AI RMF: GOVERN 6.1, MANAGE 2.2, MANAGE 2.4

OWASP LLM Top 10: LLM06:2025, LLM08:2025

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of any user on the instance. This issue has been patched in versions 1.123.18 and 2.5.0.

Exploitation Scenario

An adversary obtains a low-privilege n8n account (via phishing, credential stuffing, or an insider) on an instance orchestrating AI agent workflows. They create a new workflow containing a Function node that abuses the file access vulnerability to read /home/n8n/.env and n8n's database config — extracting OpenAI/Anthropic API keys, PostgreSQL connection strings, and n8n admin credentials in a single workflow execution. With admin credentials, they achieve full instance takeover, gain visibility into all existing AI agent workflows (including any sensitive data processed by them), and silently modify workflows to exfiltrate future inputs. The harvested LLM API keys are then used for cost harvesting or to pivot into the broader AI infrastructure. The full attack requires no technical sophistication beyond basic n8n workflow knowledge.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Primary

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.