A security flaw has been found in n8n, a popular workflow automation tool. This vulnerability could allow an authorized user to access sensitive local files or perform server-side request forgery (SSRF) attacks. This means an attacker could potentially read files on the server where n8n is running or make n8n access internal network resources it shouldn’t. This issue affects specific versions of n8n and highlights the importance of keeping software updated.
CVE Details
This vulnerability is officially identified as CVE-2026-85170. Here are the key details:
- Product: n8n
- CVE ID: CVE-2026-85170
- Published: September 3, 2026
- Severity: Medium (CVSS Score: 6.5)
- Status: Analyzed
Affected Products
The vulnerability impacts n8n versions prior to the following:
- n8n versions before 1.123.73
- n8n versions before 2.35.4
- n8n versions before 2.36.2
If you are using any n8n version older than these, your system is at risk.
Current Status
The vulnerability status is “Analyzed,” meaning it has been thoroughly investigated and understood by the vendor. Patches are available to address the issue.
Severity Level
CVE-2026-85170 is rated with a Medium severity (CVSS Score: 6.5). While not critical, a medium severity vulnerability can still pose a significant risk. In this case, an authenticated user could potentially gain access to sensitive information on the n8n server or exploit it to interact with internal systems. This could lead to data exposure or unauthorized actions within your network.
Possible Solutions
To protect your n8n instance from this vulnerability, it is crucial to apply the available patches. The issue has been addressed in the following n8n versions:
- n8n version 1.123.73 and later
- n8n version 2.35.4 and later
- n8n version 2.36.2 and later
Users should upgrade their n8n installation to one of these versions or a newer release immediately. If an immediate upgrade is not feasible, temporary mitigation steps can help reduce the risk:
- Restrict Access: Limit who can access and run workflows on your n8n instance to only fully trusted individuals. This reduces the pool of potential attackers.
- Disable Gmail Node: You can disable the vulnerable Gmail node by setting the environment variable
NODES_EXCLUDEto includen8n-nodes-base.gmail. - Least Privilege: Ensure that the n8n process runs with the lowest possible operating system privileges. This limits what an attacker could do even if they successfully exploit the vulnerability, minimizing potential damage like unauthorized file access.
Remember, these workarounds are temporary and do not fully resolve the underlying vulnerability. Prioritize upgrading your n8n instance as soon as possible.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-95ph-833c-4wrp
https://www.vulncheck.com/advisories/n8n-before-1.123.73-local-file-read-and-ssrf-via-gmail-and-brevo-nodes
