CVE-2026-25049: n8n Expression Handling Flaw Allows Host Command Execution

Overview

CVE-2026-25049 is a critical flaw in n8n, an open source workflow automation platform. The record describes a case where a logged-in user with rights to create or modify workflows can rely on how workflow parameter expressions are processed to run system commands on the host running n8n. The weakness is classified as CWE-913, Improper Control of Dynamically-Managed Code Resources.

Impact

The record states that successful exploitation leads to unintended system command execution on the host. NVD assigns CVSS 3.1 score 9.9 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which indicates network reachability, low complexity, low privileges, no user interaction, a scope change, and high impact to confidentiality, integrity and availability. GitHub, as CNA, lists a CVSS 4.0 score of 9.4.

• Confidentiality, integrity and availability of the host may be affected, according to the vector.
• The privilege needed is only workflow create or modify rights, not administrator rights.

Affected products and versions

The affected product is n8n. The record lists two ranges: versions earlier than 1.123.17, and versions from 2.0.0 up to but not including 2.5.2.

• Fixed in 1.123.17 for the 1.x line.
• Fixed in 2.5.2 for the 2.x line.

Exploitation status

The CISA KEV catalog does not list this CVE in the record consulted, so no confirmed active exploitation is recorded in the sources consulted. No EPSS score is present in the record.

Remediation and mitigation

The vendor-referenced fixes are in the commits and the GitHub advisory linked in the record. Upgrade n8n to 1.123.17 or later on the 1.x line, or to 2.5.2 or later on the 2.x line.

• Inventory all n8n instances, including test and development environments, and record their versions.
• Limit who holds workflow creation and modification rights to the smallest necessary group.
• Review accounts with those rights and remove unused or unnecessary ones.
• Where upgrading cannot happen immediately, restrict network access to the n8n interface to trusted users. The record does not describe a vendor-approved workaround, so this is a general hardening step, not a confirmed fix.

Detection guidance

• Review audit logs and workflow change history for recent creation or modification of workflows by unexpected accounts.
• Look for workflows whose parameters contain unusual or unexpected content, and review them manually.
• Monitor the n8n host for unexpected child processes or outbound connections originating from the n8n service account.

Limitations of the available information

The record does not describe the exact expression behavior, the affected components in detail, or any public proof-of-concept. It does not include an EPSS score, SSVC data or KEV details beyond the listed status. Whether default or common deployment configurations are more exposed is unknown from the record. Verify version details against the vendor advisory before acting.

Frequently asked questions

Which n8n versions are affected by CVE-2026-25049?

The record lists versions earlier than 1.123.17 and versions from 2.0.0 up to but not including 2.5.2. Upgrade to 1.123.17 or later on the 1.x line, or to 2.5.2 or later on the 2.x line.

Does this vulnerability require administrator access?

According to the record, the attacker must be an authenticated user with permission to create or modify workflows. Administrator rights are not stated as required.

Is this CVE known to be exploited in the wild?

No. The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.