Security Intelligence
Loading table of contents...
Loading table of contents...
At a glance: A critical vulnerability in the n8n automation platform could enable authenticated users with workflow‑editing access to execute malicious code and potentially pivot into connected systems. A compromise can expose sensitive data, enable workflow manipulation, and provide broad access to downstream systems. Risk varies by deployment, with the highest‑impact scenarios involving internet exposure, broad permissions, extensive integrations, and weak isolation.
Threat summary
On 19 December 2025, the n8n maintainers disclosed a critical vulnerability in the platform’s workflow expression evaluation system and released patches in versions 1.120.4, 1.121.1, and 1.122.0. n8n is an open‑source workflow automation platform used to integrate applications, orchestrate data flows, and automate operational tasks across enterprise and managed service provider environments.
The flaw, tracked as CVE‑2025‑68613, affects versions from 0.211.0 up to but not including 1.120.4, 1.121.1, and 1.122.0. The maintainers reported that, in specific scenarios, user‑supplied expressions within workflow configuration may be evaluated in a context that is not properly isolated from the underlying runtime. An authenticated user with workflow‑configuration access could exploit this behavior to execute malicious code with the privileges of the n8n process.
A successful attack can result in full compromise of the affected instance, including access to sensitive data, unauthorized workflow modification, and execution of system‑level actions. In a worst‑case scenario, a threat actor could pivot from the automation platform into connected systems, exfiltrate credentials, or manipulate operational workflows. The vulnerability carries a CVSS v3.1 score of 9.9 out of 10.
Insights & mitigations
Although the flaw requires authenticated access, many deployments grant workflow‑editing permissions to internal users or service accounts. Internet‑exposed deployments or those integrated with identity providers increase the attack surface. Because n8n often runs with elevated privileges and connects to sensitive internal systems, compromise of the automation layer can provide broad access to downstream infrastructure.
No vendor‑provided workarounds are documented beyond upgrading, and updating to the latest n8n versions remains the primary remediation path. Reviewing workflow‑configuration permissions, limiting authenticated user access, restricting network exposure, and placing n8n behind authentication gateways all reduce risk. Monitoring for unexpected workflow changes, new accounts, or anomalous process execution on hosts running n8n is also recommended.
The vulnerability’s real‑world impact depends heavily on how n8n is deployed, permissioned, and integrated, with the highest‑risk environments combining internet exposure, elevated privileges, broad integrations, and weak isolation.
Field Effect MDR users will be alerted via ARO if vulnerable systems are detected in their environment. Field Effect MDR provides continuous visibility into affected assets, detects attacker activity before or after exploitation, and supports rapid containment actions that limit operational impact.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
.jpg)