CVE-2026-25055
Last modified
CVE-2026-25055 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those remote systems potentially leading to remote code execution on those systems. EPSS estimates a 1.71% chance of exploitation in the next 30 days.
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those remote systems potentially leading to remote code execution on those systems. As a prerequisites an unauthenticated attacker needs knowledge of such workflows existing and the endpoints for file uploads need to be unauthenticated. This issue has been patched in versions 1.123.12 and 2.4.0.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| N8n | N8n | < 1.123.12 |
| N8n | N8n | >= 2.0.0, < 2.4.0f |
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-m82q-59gv-mcr9Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25055?
How severe is CVE-2026-25055?
How do I fix CVE-2026-25055?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2505The Categories Images plugin for WordPress is vulnerable to …5.4
- CVE-2026-25050Vendure is an open-source headless commerce platform. Prior …5.3
- CVE-2026-25051n8n is an open source workflow automation platform. Prior to…5.4
- CVE-2026-25052n8n is an open source workflow automation platform. Prior to…9.9
- CVE-2026-25053n8n is an open source workflow automation platform. Prior to…9.9
- CVE-2026-25054n8n is an open source workflow automation platform. Prior to…5.4
- CVE-2026-25056n8n is an open source workflow automation platform. Prior to…8.8
- CVE-2026-25057MarkUs is a web application for the submission and grading o…9.1
- CVE-2026-25058Vexa is an open-source, self-hostable meeting bot API and me…7.5
- CVE-2026-25059OpenList Frontend is a UI component for OpenList. Prior to 4…8.8
- CVE-2026-2506The EM Cost Calculator plugin for WordPress is vulnerable to…6.1
- CVE-2026-25060OpenList Frontend is a UI component for OpenList. Prior to 4…8.1
Are you affected by CVE-2026-25055?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST