n8n, a popular open-source workflow automation platform, has recently identified a critical security vulnerability, CVE-2026-44791. This flaw could allow an authenticated attacker to execute unauthorized code on the n8n server, potentially leading to a complete compromise of the system. This issue stems from a bypass of a previously patched vulnerability related to the XML node. Users running affected versions are strongly advised to update their installations immediately to protect against potential exploitation.
CVE Details
This vulnerability, identified as CVE-2026-44791, was publicly disclosed on June 23, 2026. It affects the n8n workflow automation platform, specifically its Node.js version. The core of the problem lies within the XML node, where an authenticated user with permissions to create or modify workflows can bypass a security fix meant for CVE-2026-42232. This bypass, when exploited in combination with other workflow nodes, enables an attacker to achieve Remote Code Execution (RCE) on the underlying n8n host.
Affected Products
The vulnerability impacts specific versions of the n8n workflow automation platform. Affected versions include:
- n8n versions prior to 1.123.43
- n8n versions prior to 2.22.1
- n8n versions prior to 2.20.7
If you are using n8n and your version falls into one of these categories, your system is at risk. It is crucial to check your current n8n version and plan for an immediate upgrade.
Current Status
As of June 24, 2026, the status of CVE-2026-44791 is “Analyzed.” This means that the vulnerability has been thoroughly investigated, understood, and its impact assessed by the n8n security team. Crucially, fixes have already been released, providing a clear path for users to secure their installations.
Severity Level
CVE-2026-44791 has been assigned a CVSS score of 9.9, classifying it as a “CRITICAL” severity vulnerability. This high rating indicates that the flaw presents a significant risk, allowing for severe consequences such as unauthorized code execution, potential data breaches, and complete system control by an attacker. Due to the critical nature, immediate action is highly recommended for all n8n users.
Possible Solutions
The good news is that n8n has promptly released patches to address this critical vulnerability. To secure your n8n instance, you must update to one of the following patched versions or later:
- n8n version 1.123.43
- n8n version 2.22.1
- n8n version 2.20.7
Upgrading your n8n installation to the latest stable version is always the best practice for maintaining security. If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the XML node by adding
n8n-nodes-base.xmlto theNODES_EXCLUDEenvironment variable.
Always back up your data before performing any major updates. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-wrwr-h859-xh2r
