CVE-2026-33749

n8n is an open source workflow automation platform. Prior to versions 1.123.27, 2.13.3, and 2.14.1, an authenticated user with permission to create or modify workflows could craft a workflow that produces an HTML binary data object without a filename. The `/rest/binary-data` endpoint served such responses inline on the n8n origin without `Content-Disposition` or `Content-Security-Policy` headers, allowing the HTML to render in the browser with full same-origin JavaScript access. By sending the resulting URL to a higher-privileged user, an attacker could execute JavaScript in the victim's authenticated session, enabling exfiltration of workflows and credentials, modification of workflows, or privilege escalation to admin. The issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or restrict network access to the n8n instance to prevent untrusted users from accessing binary data URLs. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

• CWE-79

• https://github.com/n8n-io/n8n/security/advisories/GHSA-qfc3-hm4j-7q77Mitigation, Vendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33743Incus is a system container and virtual machine manager. Pri…6.5
• CVE-2026-33744BentoML is a Python library for building online serving syst…7.8
• CVE-2026-33745cpp-httplib is a C++11 single-file header-only cross platfor…7.4
• CVE-2026-33746Convoy is a KVM server management panel for hosting business…9.8
• CVE-2026-33747BuildKit is a toolkit for converting source code to build ar…9.8
• CVE-2026-33748BuildKit is a toolkit for converting source code to build ar…7.5
• CVE-2026-3375The LiteSpeed Cache plugin for WordPress is vulnerable to St…7.2
• CVE-2026-33750The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-33751n8n is an open source workflow automation platform. Prior to…4.8
• CVE-2026-33752curl_cffi is the a Python binding for curl. Prior to 0.15.0,…8.6
• CVE-2026-33753rfc3161-client is a Python library implementing the Time-Sta…7.5
• CVE-2026-33754Wazuh is a free and open source platform used for threat pre…6.5