n8n at a glance
On March 11, 2026, CISA listed CVE-2025-68613 in n8n as exploited in the wild. Any logged-in user could run code on the server through workflow expressions. Fixed in 1.120.4, 1.121.1, and 1.122.0.
n8n: status
- Affected
- n8n 0.211.0 up to but not including 1.120.4
- n8n 1.121.0
- CVE identifiers
- Status as of
- Discovered by
- Reporters fatihhcelik and yuvalo1212 (credited in the n8n advisory)
What changed with n8n
CISA added CVE-2025-68613 to its Known Exploited Vulnerabilities (KEV) catalog on March 11, 2026, meaning it has evidence of real-world exploitation. US federal civilian agencies had until March 25, 2026 to remediate. n8n first disclosed the bug in GHSA-v98v-ff95-f3cp in December 2025.
The flaw sits in n8n's workflow expression evaluation. Expressions entered by an authenticated user during workflow setup could run in a context that was not isolated enough from the runtime, letting that user execute arbitrary code with the privileges of the n8n process. NVD lists n8n 0.211.0 up to 1.120.4, plus 1.121.0, as affected, with fixes in 1.120.4, 1.121.1, and 1.122.0. n8n rates it critical; NVD scores it 8.8 (high).
n8n's short-term mitigations are to limit workflow creation and editing to fully trusted users and to run n8n with restricted operating-system privileges and network access. It notes these steps reduce but do not remove the risk.
How to fix it: n8n
1. Update
Upgrade n8n to 1.120.4, 1.121.1, 1.122.0, or a later release.
nvd.nist.gov (opens in a new tab)2. Workaround
Until you upgrade, restrict workflow creation and editing to fully trusted users and run n8n with restricted OS privileges and network access.
github.com (opens in a new tab)
Advisories
Where to compare n8n
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why n8n matters for businesses
A KEV listing turns a patch note into an active threat. If your team or clients share an n8n instance with contractors or low-trust accounts, any of those logins could become server-level access to every credential stored in your automations, so confirm the version and review who can edit workflows.
Sources for this story
- Official
- n8n Remote Code Execution via Expression Injection (GHSA-v98v-ff95-f3cp) (opens in a new tab)Official
n8n on GitHub · github.com
- CVE-2025-68613 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed (opens in a new tab)Press
The Hacker News · thehackernews.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #n8n
- #cisa-kev
- #actively-exploited
- #workflow-automation