Loading story…
A critical server-side request forgery flaw in the n8n workflow automation platform, tracked as CVE-2026-56348, allowed any authenticated user to bypass the product’s Allowed HTTP Request Domains restriction and coerce the server into sending stored credentials to attacker-controlled hosts. The issue affected all versions before 2.20.0 and stemmed from missing credential permission validation in the refineResourceIds() path behind the POST /rest/dynamic-node-parameters/options endpoint, enabling exposure of API keys, OAuth tokens, and passwords without confirming credential:read access.
n8n fixed the vulnerability by adding credential access checks through CredentialsFinderService and returning a ForbiddenError when validation fails, while no public proof-of-concept had been reported at disclosure. Separately, the Canadian Centre for Cyber Security issued an advisory urging organizations to review n8n’s latest vendor notices and apply updates affecting versions prior to 1.123.64, 2.29.8, and 2.30.1, underscoring continued patching requirements across multiple release branches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-08, n8n published security advisories covering vulnerabilities affecting versions prior to 1.123.64, prior to 2.30.1, and prior to 2.29.8. The Canadian Centre for Cyber Security urged users and administrators to review the vendor advisories and apply updates.
A critical SSRF vulnerability, CVE-2026-56348, was disclosed in n8n, with reporting noting that exploitation was straightforward for authenticated users and could expose API keys, OAuth tokens, and passwords. As of June 2026, no public proof-of-concept exploit had been reported.
n8n addressed CVE-2026-56348 in version 2.20.0 by adding credential access checks through CredentialsFinderService and returning a ForbiddenError when validation fails. The flaw affected all versions prior to 2.20.0 and allowed authenticated users to bypass Allowed HTTP Request Domains restrictions to exfiltrate stored credentials.
Active exploitation of CVE-2026-33017 began within about 20 hours of the March 2026 advisory, with attackers conducting scanning, reconnaissance, and credential theft. Reported stolen data included OpenAI and Anthropic API keys, AWS credentials, and database passwords.
A March 2026 advisory disclosed CVE-2026-33017 in IBM Langflow, affecting versions up to 1.8.1 via the public flow-sharing endpoint that could pass attacker-controlled data into Python exec() without authentication or sandboxing. The issue was fixed in Langflow 1.9.0, but later reporting noted version confusion because 1.9.0 through 1.9.3 remained vulnerable to a different RCE flaw.
Perry fixed CVE-2026-53776 in version 0.5.1166 after researchers found that expired bearer tokens could remain valid indefinitely because expiration checking was disabled in the JWT verification path. The flaw affected versions before 0.5.1166 and enabled reuse of previously issued tokens after expiration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcethreataft.com
Open sourcethreataft.com
Open sourcethreataft.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
n8n published security advisories for multiple supported release branches after disclosure of several vulnerabilities, including a critical flaw tracked as **`CVE-2026-56348`**. The CVE affects versions before **`2.20.0`** and allows an authenticated user to abuse the **`POST /rest/dynamic-node-parameters/options`** endpoint to bypass **Allowed HTTP Request Domains** restrictions, causing the server to send credential-bearing HTTP requests to unauthorized hosts and potentially exfiltrate sensitive authentication data. The issue is remotely exploitable and impacts environments where users can access affected dynamic node functionality. The broader advisory set also covers additional n8n weaknesses in releases prior to **`2.28.1`**, **`2.27.4`**, and **`1.123.61`**, including another Allowed HTTP Request Domains bypass through the **AI Agents MCP Connector**, prototype pollution via workflow credentials that can lead to unauthenticated user and project enumeration, cross-issuer token exchange account binding caused by subject-only identity resolution, and a shared credential header leak through HTTP request pagination expressions. The Canadian Centre for Cyber Security urged administrators to review the advisories, upgrade to the patched versions, restrict access to exposed endpoints where possible, and monitor for unauthorized outbound requests that could indicate credential leakage.
Jun 29, 2026
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability, identified as CVE-2026-21877 and rated CVSS 10.0, was disclosed in the open-source workflow automation platform n8n. The flaw allows authenticated users to execute arbitrary code on affected instances, potentially leading to full system compromise. Both self-hosted and n8n Cloud deployments are impacted, specifically versions from 0.123.0 up to but not including 1.121.3. The vulnerability was discovered by security researcher Théo Lelasseux and has been addressed in version 1.121.3, released in November 2025. Administrators are strongly advised to upgrade immediately or, if patching is not possible, to disable the Git node and restrict access for untrusted users to mitigate risk. The disclosure follows a series of critical vulnerabilities in n8n, highlighting ongoing security challenges for the platform. The Canadian Centre for Cyber Security and other sources have issued advisories urging prompt action to apply the necessary updates. The vulnerability underscores the importance of timely patch management and access control for workflow automation tools, especially those exposed to untrusted users or the internet.
Jun 29, 2026