CVE-2026-65597: n8n DOM XSS — HIGH

Q: Is CVE-2026-65597 actively exploited?

No confirmed active exploitation of CVE-2026-65597 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65597?

Upgrade to n8n 1.123.64, 2.29.8, or 2.30.1 immediately, where the iframe sandboxing and sanitizer are fixed. Until patched, restrict who can be granted global:member accounts, limit or disable workflow sharing between untrusted users, and instruct admins/workflow owners not to open HTML previews of executions from workflows they didn't author or don't trust. Add detection for anomalous authenticated API calls (user creation, credential export, workflow edits) occurring immediately after a preview is opened, and review recent audit logs for signs of privilege escalation via this vector.

Q: What systems are affected by CVE-2026-65597?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration / automation pipelines, AI integration hubs.

Q: What is the CVSS score for CVE-2026-65597?

No CVSS score has been assigned yet.

CISO Take

This is a DOM-based cross-site scripting flaw in n8n's workflow execution preview: output is rendered into an iframe without the sandbox attribute, and a sanitizer bypass lets injected script run same-origin as the editor, so it can call authenticated n8n APIs using the victim's own session cookie. Any account with global:member privileges — a low bar in most n8n deployments — can craft the payload, and the real damage lands on whoever opens the preview, typically a workflow owner or admin with broad credential and integration access across connected AI agents and services. There's no evidence of active exploitation (not in CISA KEV), no public PoC, and no EPSS score yet, but n8n's track record of 150 prior CVEs and a middling 6.6/10 OpenSSF Scorecard argue for treating this platform's security hygiene as an ongoing concern rather than a one-off patch. n8n sits at the center of many AI agent/automation stacks (16 tracked downstream dependents), so a hijacked editor session can cascade into credential theft or workflow tampering across everything it orchestrates. Patch immediately to n8n 1.123.64, 2.29.8, or 2.30.1; in the meantime, restrict who can hold global:member accounts, review workflow-sharing permissions, and flag any unexpected authenticated API activity that follows a preview being opened.

Sources: NVD GitHub Advisory vulncheck.com OpenSSF ATLAS

What is the risk?

Exploitability is moderate: the attacker needs an existing global:member account and a sanitizer-bypass payload, then depends on a higher-privileged user opening the crafted preview — not a zero-click, but a low bar in collaborative n8n environments where workflow sharing is common. Impact is significant because the payload executes with the victim's authenticated session, enabling API calls that could exfiltrate stored credentials, modify workflows, or escalate privileges within the instance. With no CISA KEV listing, no EPSS score, no public exploit, and no Nuclei template, there's no signal of active or imminent mass exploitation, but the combination of a same-origin session-riding primitive and n8n's role as an automation hub for AI agents and connected services keeps overall risk at Medium-High for any instance with untrusted or semi-trusted internal users.

How does the attack unfold?

Malicious workflow creation

An attacker with a global:member account crafts a workflow whose execution output embeds a payload that bypasses n8n's HTML sanitizer.

AML.T0012

Victim opens HTML preview

A higher-privileged user opens the execution's HTML preview, which renders the payload into an iframe lacking the sandbox attribute.

Same-origin script execution

The injected script executes same-origin as the n8n editor, inheriting the victim's authenticated session context.

Authenticated API abuse

The script calls n8n's authenticated APIs as the victim, enabling credential theft, workflow tampering, or account/privilege escalation.

AML.T0106

Malicious workflow creation

An attacker with a global:member account crafts a workflow whose execution output embeds a payload that bypasses n8n's HTML sanitizer.

AML.T0012

Victim opens HTML preview

A higher-privileged user opens the execution's HTML preview, which renders the payload into an iframe lacking the sandbox attribute.

Same-origin script execution

The injected script executes same-origin as the n8n editor, inheriting the victim's authenticated session context.

Authenticated API abuse

The script calls n8n's authenticated APIs as the victim, enabling credential theft, workflow tampering, or account/privilege escalation.

AML.T0106

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.64	`1.123.64`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade to n8n 1.123.64, 2.29.8, or 2.30.1 immediately, where the iframe sandboxing and sanitizer are fixed. Until patched, restrict who can be granted global:member accounts, limit or disable workflow sharing between untrusted users, and instruct admins/workflow owners not to open HTML previews of executions from workflows they didn't author or don't trust. Add detection for anomalous authenticated API calls (user creation, credential export, workflow edits) occurring immediately after a preview is opened, and review recent audit logs for signs of privilege escalation via this vector.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent API AML.T0012 - Valid Accounts AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - Security of AI system components

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

Frequently Asked Questions

What is CVE-2026-65597?

This is a DOM-based cross-site scripting flaw in n8n's workflow execution preview: output is rendered into an iframe without the sandbox attribute, and a sanitizer bypass lets injected script run same-origin as the editor, so it can call authenticated n8n APIs using the victim's own session cookie. Any account with global:member privileges — a low bar in most n8n deployments — can craft the payload, and the real damage lands on whoever opens the preview, typically a workflow owner or admin with broad credential and integration access across connected AI agents and services. There's no evidence of active exploitation (not in CISA KEV), no public PoC, and no EPSS score yet, but n8n's track record of 150 prior CVEs and a middling 6.6/10 OpenSSF Scorecard argue for treating this platform's security hygiene as an ongoing concern rather than a one-off patch. n8n sits at the center of many AI agent/automation stacks (16 tracked downstream dependents), so a hijacked editor session can cascade into credential theft or workflow tampering across everything it orchestrates. Patch immediately to n8n 1.123.64, 2.29.8, or 2.30.1; in the meantime, restrict who can hold global:member accounts, review workflow-sharing permissions, and flag any unexpected authenticated API activity that follows a preview being opened.

Is CVE-2026-65597 actively exploited?

No confirmed active exploitation of CVE-2026-65597 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65597?

Upgrade to n8n 1.123.64, 2.29.8, or 2.30.1 immediately, where the iframe sandboxing and sanitizer are fixed. Until patched, restrict who can be granted global:member accounts, limit or disable workflow sharing between untrusted users, and instruct admins/workflow owners not to open HTML previews of executions from workflows they didn't author or don't trust. Add detection for anomalous authenticated API calls (user creation, credential export, workflow edits) occurring immediately after a preview is opened, and review recent audit logs for signs of privilege escalation via this vector.

What systems are affected by CVE-2026-65597?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration / automation pipelines, AI integration hubs.

What is the CVSS score for CVE-2026-65597?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration / automation pipelinesAI integration hubs

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

Exploitation Scenario

An attacker who holds or compromises a global:member n8n account builds a workflow whose execution output embeds a crafted payload that slips past the HTML sanitizer. They share the workflow — or wait for it to surface in a shared project — until a higher-privileged user (an admin or workflow owner) opens the execution's HTML preview. Because the iframe lacks the sandbox attribute, the injected script runs same-origin as the n8n editor and inherits the victim's session, letting the attacker's script silently call n8n's authenticated APIs: creating a new admin account, exporting credentials stored in connected AI/API nodes, or rewriting other workflows to establish persistence — all without the victim ever knowing their session was used.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.