CVE-2026-25056
Last modified
CVE-2026-25056 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remote code execution. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remote code execution. This issue has been patched in versions 1.118.0 and 2.4.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| N8n | N8n | < 1.118.0 |
| N8n | N8n | >= 2.0.0, < 2.4.0 |
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-hv53-3329-vmrmPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25056?
How severe is CVE-2026-25056?
How do I fix CVE-2026-25056?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-25050Vendure is an open-source headless commerce platform. Prior …5.3
- CVE-2026-25051n8n is an open source workflow automation platform. Prior to…5.4
- CVE-2026-25052n8n is an open source workflow automation platform. Prior to…9.9
- CVE-2026-25053n8n is an open source workflow automation platform. Prior to…9.9
- CVE-2026-25054n8n is an open source workflow automation platform. Prior to…5.4
- CVE-2026-25055n8n is an open source workflow automation platform. Prior to…8.1
- CVE-2026-25057MarkUs is a web application for the submission and grading o…9.1
- CVE-2026-25058Vexa is an open-source, self-hostable meeting bot API and me…7.5
- CVE-2026-25059OpenList Frontend is a UI component for OpenList. Prior to 4…8.8
- CVE-2026-2506The EM Cost Calculator plugin for WordPress is vulnerable to…6.1
- CVE-2026-25060OpenList Frontend is a UI component for OpenList. Prior to 4…8.1
- CVE-2026-25061tcpflow is a TCP/IP packet demultiplexer. In versions up to …7.5
Are you affected by CVE-2026-25056?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST