CVE-2026-25052
BaseFortify
Publication date: 2026-02-04
Last updated on: 2026-02-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n8n | n8n | to 1.123.18 (exc) |
| n8n | n8n | From 2.0.0 (inc) to 2.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-Other | |
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the n8n workflow automation platform prior to versions 1.123.18 and 2.5.0. It involves improper file access controls that allow authenticated users who have permission to create or modify workflows to read sensitive files on the host system where n8n is running.
By exploiting this flaw, an attacker can obtain critical configuration data and user credentials stored on the host, which can lead to a complete takeover of any user account on the n8n instance.
This vulnerability has been fixed in versions 1.123.18 and 2.5.0.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with workflow creation or modification permissions to access sensitive files on the n8n host system.
This can lead to exposure of critical configuration data and user credentials.
Ultimately, this can result in a complete account takeover of any user on the n8n instance, potentially compromising the entire system and its workflows.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade your n8n installation to version 1.123.18 or later, or version 2.5.0 or later, where the issue has been patched.