N8n — Cyber Threats, Attacks & Incidents

Related Threat Clusters

• Critical n8n Vulnerability Enables Arbitrary Command Execution

  A critical vulnerability in the n8n workflow automation platform, tracked as CVE-2025-68668, allows authenticated users to execute arbitrary system commands on affected servers. With a CVSS score of 9.9, this flaw…

  19 articles · Updated January 6, 2026
• Critical RCE Vulnerability in n8n Affects Over 100K Servers

  A critical remote code execution vulnerability (CVE-2025-68613) in the n8n workflow automation platform has been disclosed, potentially impacting over 100,000 servers, primarily in the United States. The flaw, which has…

  4 articles · Updated December 24, 2025
• Critical n8n RCE Vulnerability Exploit Code Released

  Security researchers have released proof-of-concept exploit code for a critical remote code execution vulnerability affecting n8n. This vulnerability poses significant risks to users of the platform, enabling potential…

  2 articles · Updated December 23, 2025
• Iranian APT Groups Target Israeli Organizations with Modular C2 Frameworks

  In 2026, Iranian APT groups, notably Cavern Manticore and OilRig, have intensified cyber operations against Israeli organizations, primarily in the IT and government sectors. Cavern Manticore employs a modular…

  10 articles · Updated July 6, 2026
• Critical RCE Vulnerability in Marimo Exploited Within 10 Hours of Disclosure

  On April 8, 2026, a critical pre-authenticated remote code execution vulnerability (CVE-2026-39987) was disclosed in Marimo, an open-source Python notebook platform. The flaw allows unauthenticated attackers to gain a…

  2 articles · Updated June 9, 2026
• Langflow IDOR Exploit and Critical Vulnerabilities Targeting AI Platforms

  A moderate-scored IDOR vulnerability (CVE-2026-55255) in Langflow has been actively exploited since June 25, 2026, allowing attackers to access and execute flows belonging to other users. This exploit leverages a…

  2 articles · Updated July 25, 2026
• Exploitation of N8n Flaw and Linux Vulnerabilities Highlight Cybersecurity Risks

  Recent reports indicate that a vulnerability in N8n has been actively exploited, posing significant risks to users. Additionally, researchers from Qualys have identified nine vulnerabilities in the Linux AppArmor, which…

  2 articles · Updated March 13, 2026
• Critical n8n RCE Vulnerability Requires Immediate Update

  n8n has issued a critical security alert regarding a remote code execution (RCE) vulnerability identified as CVE-2026-21877. Users are urged to update to version 1.121.3 to mitigate potential attacks. This vulnerability…

  5 articles · Updated January 7, 2026
• Critical n8n Vulnerability Exposes 103,000+ Instances to RCE Attacks

  A critical remote code execution vulnerability, tracked as CVE-2025-68613, has been identified in the n8n automation platform, affecting over 103,000 instances globally. The flaw allows authenticated attackers to…

  4 articles · Updated December 23, 2025
• Critical DifyTap Vulnerabilities Expose AI Data Across 1M+ Apps

  Zafran Labs identified four vulnerabilities in Dify, an open-source AI platform used by over one million applications, including critical flaws allowing cross-tenant data leakage. Two vulnerabilities, CVE-2026-41947 and…

  8 articles · Updated June 23, 2026

Recent Intelligence Reports

• >> Read this brief on krypteiasec.com — krypteiasec.com · July 26, 2026
• Daily Threat Brief: July 24, 2026 — Buttondown · July 25, 2026
• Iranian State-Sponsored 'Cavern' C2 Framework Targets Israeli IT and Government Sectors — Qpulse.Quasarcybertech · July 7, 2026
• Zafran also identified prolonged exposure — www.zafran.io · June 23, 2026
• Marimo Oss Python Notebook Rce From Disclosure To Exploitation In Under 10 Hours — webflow.sysdig.com · June 9, 2026
• Critical n8n Vulnerabilities Expose Automation Nodes to Full RCE — Cybersecuritynews · May 18, 2026
• n8n Security Flaws Could Let Attackers Achieve Remote Code Execution — Gbhackers · May 18, 2026
• n8n Abuse Fuels AI-Driven Phishing and Malware — Socprime · April 16, 2026

Related Entities