CVE-2026-54687: n8n path traversal

CISO Take

A community SQLite node for n8n let workflow authors bind the database file path directly to a node parameter, so any workflow that mapped untrusted input (a webhook field, a form submission, an AI agent tool argument) into that parameter let an attacker redirect which file SQLite opened, enabling path traversal to read or overwrite arbitrary files reachable by the n8n process. There is no CVSS score, no CISA KEV listing, no public exploit or Nuclei template, and downstream dependents are reported as zero, so blast radius today is narrow — but the flaw requires no AI/ML expertise to exploit once the wiring exists, and n8n is frequently used as the orchestration backbone for AI agent workflows, including multi-tenant automation platforms where end users author their own workflows. The vendor already fixed this by moving the path into a server-side credential in v2 (1.0.0), closing the class of bug rather than patching a single instance. Upgrade to n8n-nodes-sqlite3 >=1.0.0, audit existing workflows for any expression-bound db_path parameters, and in any user-facing or multi-tenant n8n deployment restrict who can install or configure this node until the upgrade is confirmed.

Sources: GitHub Advisory OpenSSF ATLAS

What is the risk?

Medium severity as rated, but exploitability is conditional rather than direct: an attacker needs a workflow that already wires untrusted input into the db_path field, so single-tenant deployments where only trusted operators author workflows are effectively unaffected. Risk rises sharply in multi-tenant or user-facing n8n deployments — including AI agent-builder SaaS products built on n8n — where lower-privileged users or external input can influence workflow parameters. No active exploitation, KEV listing, EPSS data, public PoC, or scanner template exists, and the affected package (n8n-nodes-sqlite3, a third-party community node, not n8n core) shows zero downstream dependents in this dataset, which caps near-term mass-exploitation likelihood.

How does the attack unfold?

Misconfigured wiring

A workflow author maps an untrusted input field (webhook, form, or agent tool argument) to the SQLite node's db_path parameter.

AML.T0081

Path traversal injection

An attacker submits a crafted path traversal string through the wired input at workflow runtime, redirecting which file the SQLite node opens.

AML.T0053

Arbitrary file read or overwrite

The n8n process opens the attacker-controlled file path, exposing sensitive data or corrupting files it can access, including credentials or other tenants' data.

AML.T0086

Misconfigured wiring

A workflow author maps an untrusted input field (webhook, form, or agent tool argument) to the SQLite node's db_path parameter.

AML.T0081

Path traversal injection

An attacker submits a crafted path traversal string through the wired input at workflow runtime, redirecting which file the SQLite node opens.

AML.T0053

Arbitrary file read or overwrite

The n8n process opens the attacker-controlled file path, exposing sensitive data or corrupting files it can access, including credentials or other tenants' data.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.0.0	`1.0.0`
201.9K OpenSSF 6.7 Pushed 5d ago 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Upgrade n8n-nodes-sqlite3 to >=1.0.0, which moves the database path into a server-side credential (v2 architecture) no longer controllable via workflow input data. Audit all existing workflows for db_path parameters bound to expressions, form fields, webhook payloads, or agent tool outputs, and remove any such bindings even after patching. In multi-tenant or user-facing n8n deployments, restrict which users can install or configure community nodes, and run the n8n process under a least-privilege filesystem policy (containerized, read-only root, scoped bind mounts) so a traversal cannot reach credentials or other tenants' data even if a misconfigured node slips through. Detection: monitor for unexpected file access outside the expected SQLite data directory from the n8n process, and flag workflow definitions where db_path resolves from an expression rather than a static value.

How is it classified?

Data Leakage Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8 - AI system life cycle security

NIST AI RMF

MANAGE 2.3 - Risks from third-party AI components are monitored and managed

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-54687?

A community SQLite node for n8n let workflow authors bind the database file path directly to a node parameter, so any workflow that mapped untrusted input (a webhook field, a form submission, an AI agent tool argument) into that parameter let an attacker redirect which file SQLite opened, enabling path traversal to read or overwrite arbitrary files reachable by the n8n process. There is no CVSS score, no CISA KEV listing, no public exploit or Nuclei template, and downstream dependents are reported as zero, so blast radius today is narrow — but the flaw requires no AI/ML expertise to exploit once the wiring exists, and n8n is frequently used as the orchestration backbone for AI agent workflows, including multi-tenant automation platforms where end users author their own workflows. The vendor already fixed this by moving the path into a server-side credential in v2 (1.0.0), closing the class of bug rather than patching a single instance. Upgrade to n8n-nodes-sqlite3 >=1.0.0, audit existing workflows for any expression-bound db_path parameters, and in any user-facing or multi-tenant n8n deployment restrict who can install or configure this node until the upgrade is confirmed.

Is CVE-2026-54687 actively exploited?

No confirmed active exploitation of CVE-2026-54687 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54687?

Upgrade n8n-nodes-sqlite3 to >=1.0.0, which moves the database path into a server-side credential (v2 architecture) no longer controllable via workflow input data. Audit all existing workflows for db_path parameters bound to expressions, form fields, webhook payloads, or agent tool outputs, and remove any such bindings even after patching. In multi-tenant or user-facing n8n deployments, restrict which users can install or configure community nodes, and run the n8n process under a least-privilege filesystem policy (containerized, read-only root, scoped bind mounts) so a traversal cannot reach credentials or other tenants' data even if a misconfigured node slips through. Detection: monitor for unexpected file access outside the expected SQLite data directory from the n8n process, and flag workflow definitions where db_path resolves from an expression rather than a static value.

What systems are affected by CVE-2026-54687?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines.

What is the CVSS score for CVE-2026-54687?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation pipelines

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.8

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.

Exploitation Scenario

A SaaS product embeds n8n to let its own end users build automation/AI agent workflows. One workflow author — possibly a low-privileged tenant or someone with limited authoring rights — wires a webhook or form field into the SQLite node's db_path parameter to make the workflow 'configurable.' An attacker submitting input to that webhook supplies a path traversal payload such as '../../../../opt/n8n/credentials.sqlite' or a path pointing at another tenant's data file. At runtime the node opens the attacker-specified file instead of the intended one, returning its contents back through the workflow (arbitrary file read) or, if the node writes to it, corrupting the target file (arbitrary file overwrite) — all without needing any AI/ML-specific technique, just control over one wired parameter.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.