Critical n8n RCE Vulnerability Enables Full Server Compromise
Summary:
A critical vulnerability, tracked as CVE-2025-68613 with a CNA CVSS score of 9.9, has been disclosed in the n8n workflow automation platform. The flaw stems from insufficient isolation of authenticated user-supplied expressions from the underlying runtime during workflow configuration under certain conditions. Its CWE is the improper control of dynamically-managed code resources (CWE-913). This allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process, potentially leading to a full instance compromise, unauthorized data access, and the execution of system-level operations. The vulnerability affects all versions from 0.211.0 up to 1.120.4. Patches are available in versions:
Security Officer Comments:
The high CVSS base score of 9.9 reinforces the notion of the dangerous intersection of AI agent-powered workflow automation platforms and the potential for arbitrary code execution. Although the requirement for authentication would be expected to lower the potential risk of this vulnerability, the widespread adoption of n8n for sensitive business process orchestration makes this an attractive target for lateral movement or software supply chain attacks. Ultimately, this is reflected in the vulnerability’s CVSS Impact subscore (6.0) and CVSS Exploitability subscore (3.1). Organizations should prioritize patching immediately, as the sheer volume of internet-facing instances suggests that automated exploitation attempts by opportunistic threat actors are likely.
Suggested Corrections:
This issue has been fixed in n8n v1.122.0.
Users are strongly advised to upgrade to version 1.122.0 or later, which introduces additional safeguards to restrict expression evaluation.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
Link(s):
https://orca.security/resources/blog/cve-2025-68613-n8n-rce-vulnerability/
https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp
A critical vulnerability, tracked as CVE-2025-68613 with a CNA CVSS score of 9.9, has been disclosed in the n8n workflow automation platform. The flaw stems from insufficient isolation of authenticated user-supplied expressions from the underlying runtime during workflow configuration under certain conditions. Its CWE is the improper control of dynamically-managed code resources (CWE-913). This allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process, potentially leading to a full instance compromise, unauthorized data access, and the execution of system-level operations. The vulnerability affects all versions from 0.211.0 up to 1.120.4. Patches are available in versions:
- 1.120.4
- 1.121.1
- 1.122.0
Security Officer Comments:
The high CVSS base score of 9.9 reinforces the notion of the dangerous intersection of AI agent-powered workflow automation platforms and the potential for arbitrary code execution. Although the requirement for authentication would be expected to lower the potential risk of this vulnerability, the widespread adoption of n8n for sensitive business process orchestration makes this an attractive target for lateral movement or software supply chain attacks. Ultimately, this is reflected in the vulnerability’s CVSS Impact subscore (6.0) and CVSS Exploitability subscore (3.1). Organizations should prioritize patching immediately, as the sheer volume of internet-facing instances suggests that automated exploitation attempts by opportunistic threat actors are likely.
Suggested Corrections:
This issue has been fixed in n8n v1.122.0.
Users are strongly advised to upgrade to version 1.122.0 or later, which introduces additional safeguards to restrict expression evaluation.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Deploy n8n in a hardened environment with restricted operating system privileges and network access
Link(s):
https://orca.security/resources/blog/cve-2025-68613-n8n-rce-vulnerability/
https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp