CVE Intelligence
Analysis AI-assisted

CVE-2026-25052: n8n Sensitive File Read Vulnerability

CVE-2026-25052 is a critical flaw in n8n, an open source workflow automation platform, affecting versions before 1.123.18 and versions from 2.0.0 up to but not including 2.5.0. According to the record, authenticated users who can create or modify workflows may read sensitive files from the host system, potentially exposing configuration data and credentials. The vendor reports the issue is fixed in 1.123.18 and 2.5.0.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25052 affects n8n, an open source workflow automation platform. The record describes a weakness in file access controls that lets authenticated users with permission to create or modify workflows read sensitive files from the host system.

Impact

  • Exposure of critical configuration data and user credentials, as described in the record.
  • The record states this can lead to complete account takeover of any user on the instance.
  • The CVSS 3.1 vector in NVD records high confidentiality, integrity and availability impact with a changed scope.

Affected products and versions

  • n8n versions earlier than 1.123.18.
  • n8n versions from 2.0.0 up to but not including 2.5.0.
  • The vendor reports fixes in 1.123.18 and 2.5.0, as described in the linked GitHub security advisory.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the data consulted, and no EPSS score is available. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade to 1.123.18 or 2.5.0, depending on the release line in use.
  • Review the vendor advisory for official guidance.
  • Restrict workflow creation and modification permissions to trusted users until the upgrade is complete.
  • If exposure is suspected, rotate credentials that were stored or reachable on the host.

Detection guidance

  • Review audit logs for workflow creation or changes made by unexpected accounts.
  • Monitor the n8n host for unusual file access by the n8n process.
  • Check recently modified workflows for references to sensitive host files.

Limitations of the available information

  • The record does not identify specific files or the exact technical mechanism.
  • The record lists CWE-367 (TOCTOU Race Condition), but the description does not explain how it applies here.
  • NVD reports a CVSS 3.1 score of 9.9 and GitHub reports a CVSS 4.0 score of 9.4.
  • Whether any instance has been targeted is unknown.

Frequently asked questions

What versions of n8n are affected by CVE-2026-25052?

According to the record, n8n versions earlier than 1.123.18 and versions from 2.0.0 up to but not including 2.5.0 are affected.

Has this vulnerability been fixed?

The record states the issue is patched in versions 1.123.18 and 2.5.0. Consult the vendor advisory for official upgrade guidance.

Is this CVE known to be actively exploited?

This CVE is not listed in the CISA KEV catalog in the data consulted, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.