n8n: workflow editors can run commands on the host by escaping the expression sandbox again (CVE-2026-25049)
Severity: high · Patch status: patched · Since 2026-02-04 · CVE-2026-25049
After fixing CVE-2025-68613, n8n found and patched further ways to break out of its workflow expression evaluator. A logged-in user allowed to create or modify workflows can put crafted expressions in workflow parameters and make the host running n8n execute system commands, with the n8n process's rights over its stored credentials and workflows. All 1.x releases before 1.123.17 and 2.x before 2.5.2 are affected; the advisory was published on 2026-02-04. It is not in CISA's Known Exploited Vulnerabilities catalog, though the closely related CVE-2025-68613 is. We rate it high rather than the CNA's critical because it needs a valid account with workflow-edit rights. The vendor's workarounds (limit workflow editing to fully trusted users, run n8n with restricted OS privileges and network access) only reduce the risk; upgrading is the fix.
What to do
- Upgrade n8n to 1.123.17 (1.x) or 2.5.2 (2.x) or later; this also covers CVE-2025-68613 and CVE-2026-21858.
- Until patched, limit workflow creation and editing to fully trusted users, and run n8n with restricted OS privileges and network access, as the vendor advises.
- Keep the n8n editor and login page off the public internet. If it is exposed only to receive webhooks, receive them through a relay such as Webhook Relay (https://webhookrelay.com/blog/n8n-security/), so only the relay's public URL faces the internet. This shrinks who can reach an editor session; it does not fix the bug for anyone who already has an account.
- Review recently created or changed workflows and expressions on instances that had untrusted editors, and rotate the credentials stored in n8n if anything is unexplained.
Fixed versions
Sources
All live incidents on Threat Watch
