Skip to content
Critical RCE Vulnerability in n8n Workflow Automation Platform

Critical RCE Vulnerability in n8n Workflow Automation Platform

First seen 30 Oct 2026, 16:53 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 19:16 UTC
  • •CVE-2025-68613 allows RCE in n8n versions 0.211.0 to <1.120.4.
  • •Exploitation requires authenticated users with edit permissions.
  • •Immediate upgrade to version 1.122.0 or higher is recommended.

N8n, a workflow automation platform, has a critical Remote Code Execution (RCE) vulnerability identified as CVE-2025-68613, with a CVSS score of 9.9. This flaw affects versions from 0.211.0 to prior to 1.120.4, 1.121.1, and 1.122.0, allowing authenticated users with edit permissions to execute arbitrary code on the server. Exploitation can lead to unauthorized access to sensitive data and modification of workflows. The vulnerability was publicly disclosed on December 19, 2025, and has been since March 11, 2026, when it was added to the CISA KEV catalog. Users are urged to upgrade to version 1.122.0 or higher to mitigate the risk. Temporary mitigations include limiting workflow permissions and deploying n8n in a restricted environment.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-12-19
CVE-2025-68613 published
n8n disclosed a critical RCE vulnerability affecting multiple versions, with a CVSS score of 9.9.
Sploitus
2025-12-22
First public PoC released
Proof-of-concept code demonstrating the RCE vulnerability was made publicly available.
Sploitus
2026-03-11
CVE added to CISA KEV catalog
CISA confirmed active exploitation of CVE-2025-68613 in the wild.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2025-68613 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

Which versions of n8n are affected?
Versions from 0.211.0 up to but not including 1.120.4, 1.121.1, and 1.122.0 are affected.
Is this vulnerability being actively exploited?
Yes, it was confirmed as actively exploited in the wild as of March 11, 2026.
What should users do to protect themselves?
Users should upgrade to version 1.122.0 or higher immediately to mitigate the risk.