In today’s interconnected digital landscape, workflow automation platforms like n8n are indispensable for streamlining operations. However, the very tools designed for efficiency can become targets for malicious actors if not properly secured. A recent discovery has highlighted a significant security vulnerability in n8n, posing a risk to user sessions and data integrity.
Overview
A notable security vulnerability, identified as CVE-2026-54301, has been found in n8n, an open-source platform for building and automating workflows. This flaw is a type of Cross-Site Scripting (XSS) that could allow an attacker to execute malicious JavaScript code within an authenticated user’s browser. The vulnerability arises when an authenticated user with workflow editing privileges configures a “Respond to Webhook” node to serve binary content with a content type chosen by the attacker. This malicious path bypasses n8n’s Content-Security-Policy (CSP) protections. As a result, if an authenticated user then visits this public webhook, the injected JavaScript could run, granting the attacker access to that user’s session and potentially leading to unauthorized actions or data theft.
CVE Details
- Product Name: n8n
- Published Date: June 23, 2026
- Severity: Medium (CVSS 5.4)
- Status: Analyzed
Affected Products
The following versions of n8n are susceptible to this vulnerability:
- All n8n versions prior to 1.123.55
- All n8n versions prior to 2.25.7
- All n8n versions prior to 2.26.2
Current Status
This vulnerability has been thoroughly analyzed and publicly disclosed. Comprehensive information regarding its nature, potential impact, and crucial mitigation strategies is now readily available to ensure users can take appropriate measures to secure their n8n installations.
Severity Level
According to the Common Vulnerability Scoring System (CVSS), this vulnerability is rated as Medium (CVSS 5.4). A Medium severity rating typically indicates that while the vulnerability is a concern, its exploitation might require specific conditions or a degree of user interaction. It’s important to note that the GitHub security advisory associated with this CVE has assigned a ‘High’ severity rating (CVSS 7.0), emphasizing a potentially greater risk, particularly concerning the confidentiality of user data. Regardless of the specific numerical score, the potential for unauthorized session access through XSS makes addressing this vulnerability a priority.
Possible Solutions
To safeguard your n8n environment from this Cross-Site Scripting vulnerability, upgrading to a patched version is the most effective solution. The following versions include the necessary fixes:
- Upgrade to n8n version 1.123.55 or later.
- Upgrade to n8n version 2.25.7 or later.
- Upgrade to n8n version 2.26.2 or later.
If an immediate upgrade is not feasible, here are temporary mitigation steps you can consider:
- Limit Workflow Permissions: Strictly restrict the ability to create or edit workflows to a small group of highly trusted administrators or users. This limits the number of individuals who could potentially introduce a malicious webhook.
- Disable the Respond to Webhook Node: As a short-term measure, you can disable the vulnerable “Respond to Webhook” node entirely. This can be done by adding
n8n-nodes-base.respondToWebhookto theNODES_EXCLUDEenvironment variable in your n8n setup. Keep in mind that these workarounds are temporary and should be replaced by a full upgrade as soon as possible.References
https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm
