Skip to content
Stored XSS Vulnerability in n8n Webhook Responses

Stored XSS Vulnerability in n8n Webhook Responses

First seen 29 Oct 2026, 08:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 09:09 UTC
  • •CVE-2026-118648 affects multiple n8n versions due to stored XSS vulnerability.
  • •Attackers can exploit the flaw via crafted webhook responses to execute scripts.
  • •Immediate upgrade to patched versions is recommended to mitigate risks.

A stored cross-site scripting vulnerability (CVE-2026-118648) has been identified in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1. This flaw arises from missing sandbox Content-Security-Policy in certain webhook responses, allowing authenticated users to serve malicious HTML that executes in the context of the n8n origin. Attackers with low-privilege accounts can exploit this by crafting webhook responses that run scripts when users access the URLs. The vulnerability is classified as high severity with a CVSS score of 8.4. Self-hosted and hosted deployments with accessible webhook endpoints are particularly at risk. Prompt remediation is advised, including upgrading to fixed versions or restricting workflow creation to trusted users. The vulnerability was published on October 28, 2026, but active exploitation status remains unconfirmed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
CVE-2026-118648 published
The stored XSS vulnerability in n8n was officially disclosed with a CVSS score of 8.4.
Redpacketsecurity
2026-10-29
Vulnerability alert issued
Security advisories warn users of the stored XSS vulnerability and recommend immediate action.
www.vulncheck.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-118648 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

Which versions are affected?
n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 are affected.
Is there a patch available?
Yes, users are advised to upgrade to the vendor-fixed releases to mitigate the vulnerability.
What should I do if I can't upgrade immediately?
Restrict workflow creation and activation to trusted users and limit public webhook exposure until patched.