Summary
Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.
Product
n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.
Vulnerabilities 3
-
Critical 10.0
n8n Vulnerable to Remote Code Execution via Expression Injection
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions…
KEV Mar 11, 2026 -
Critical 10.0
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an u…
-
Medium 6.5
n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks
n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The St…
Revision history
-
#3
Aktive Ausnutzung gemeldet
-
#2
fehlerhaften Link entfernt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-v4pr-fm98-w9pg vom 2026-01-07
https://github.com/advisories/GHSA-v4pr-fm98-w9pg
-
Cyera Research vom 2026-01-07
https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
-
GitHub Security Advisory GHSA-jf52-3f2h-h9j5 vom 2026-01-07
https://github.com/advisories/GHSA-jf52-3f2h-h9j5
-
PoC CVE-2025-68613 vom 2026-01-07
https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp
-
PoC CVE-2025-68613 + CVE-2026-21858 vom 2026-01-07
https://github.com/Chocapikk/CVE-2026-21858
-
CISA Known Exploited Vulnerabilities Catalog vom 2026-03-11
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613