Loading story…
n8n disclosed multiple high-severity vulnerabilities affecting the workflow automation platform, including an authentication bypass, security restrictions bypass, arbitrary file read and write, denial of service, and a remote code execution flaw in the Git node. The issues affect 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, with exposure spanning both self-hosted and cloud deployments.
The Git node vulnerability allows an authenticated user with permission to create and run workflows to prepare a crafted local repository that triggers Git hooks under default Git security settings, leading to arbitrary command execution as the n8n process user. Italy's national CSIRT said the vendor has published security guidance and urged organizations running affected versions to apply the recommended mitigations and updates.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A high-severity vulnerability in n8n's Send Email node, tracked as CVE-2026-72766, was disclosed affecting versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1. The type confusion flaw can cause Nodemailer to treat crafted body-field input as a file path or URL, enabling arbitrary local file disclosure and SSRF under specific non-default conditions.
A remote code execution flaw in the n8n Git node was documented for versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1. The vulnerability allows an authenticated user with workflow creation and execution rights to prepare a crafted local repository that triggers Git hooks and executes arbitrary commands as the n8n process user.
The n8n-io development team identified and disclosed several high-severity vulnerabilities in n8n, including authentication bypass, security restrictions bypass, arbitrary file read/write, arbitrary code execution, and denial of service. The issues affect n8n 1.x before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecvefeed.io
Open sourcevulncheck.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-65964, has been identified in the workflow automation tool *n8n*. The flaw allows attackers to achieve RCE by manipulating the Git node's custom pre-commit hook configuration, potentially enabling unauthorized access and control over affected systems. Security advisories highlight the severity of this issue, with a CVSS 4.0 score of 9.4, categorizing it as critical and emphasizing the urgent need for remediation. The vulnerability exposes organizations using *n8n* to significant risk, as exploitation could lead to full system compromise. Administrators are strongly advised to review their deployments, apply available patches, and monitor for any signs of unauthorized activity related to Git node configurations. No evidence of active exploitation has been reported as of the latest advisories, but the technical nature of the flaw and its critical rating warrant immediate attention from security teams.
Jun 29, 2026
A critical remote code execution vulnerability, tracked as CVE-2026-21877, has been identified in the n8n workflow automation platform. The flaw, rated CVSS 10.0, allows authenticated users to execute arbitrary code on affected n8n instances, posing a significant risk to environments where n8n is used to automate workflows with access to sensitive data, internal systems, and credentials. The vulnerability impacts n8n versions from 0.123.0 up to but not including 1.121.3, affecting both self-hosted and managed deployments. Exploitation requires authenticated access, and the vulnerability is linked to unsafe handling that can result in the execution of untrusted code. The issue has been addressed in n8n version 1.121.3 and later, and users are strongly advised to upgrade immediately to mitigate the risk. Additional recommendations include restricting workflow modification access to trusted administrators, blocking high-risk nodes at runtime, and reviewing audit logs for suspicious activity prior to patching. No public exploit details or proof-of-concept have been released as of the latest advisories. Organizations using n8n should prioritize patching and implement hardening measures to prevent potential compromise of their automation infrastructure.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability, identified as CVE-2026-21877 and rated CVSS 10.0, was disclosed in the open-source workflow automation platform n8n. The flaw allows authenticated users to execute arbitrary code on affected instances, potentially leading to full system compromise. Both self-hosted and n8n Cloud deployments are impacted, specifically versions from 0.123.0 up to but not including 1.121.3. The vulnerability was discovered by security researcher Théo Lelasseux and has been addressed in version 1.121.3, released in November 2025. Administrators are strongly advised to upgrade immediately or, if patching is not possible, to disable the Git node and restrict access for untrusted users to mitigate risk. The disclosure follows a series of critical vulnerabilities in n8n, highlighting ongoing security challenges for the platform. The Canadian Centre for Cyber Security and other sources have issued advisories urging prompt action to apply the necessary updates. The vulnerability underscores the importance of timely patch management and access control for workflow automation tools, especially those exposed to untrusted users or the internet.
Jun 29, 2026