Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows
Summary: n8n disclosed CVE-2026-25049, a critical workflow automation flaw rated CVSS 9.4, caused by inadequate sanitization that bypasses the fix for CVE-2025-68613, a 9.9 defect patched in December 2025. An authenticated user with permission to create or modify workflows can abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host, and researchers including Fatih Çelik, Endor Labs' Cris Staicu, Pillar Security's Eilon Cohen, and SecureLayer7's Sandeep Kamble were acknowledged for the finding.
Why it matters: Pillar Security's Eilon Cohen put the exposure plainly: if you can create a workflow, you can own the server, and a public webhook with no authentication lets anyone on the internet trigger the payload remotely. n8n also released alerts for 11 other flaws, five of them critical, so the patch window covers more than one hole.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-68613CVE-2026-25049
- Related
- CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability Known Exploited Vulnerabilities · Mar 11, 2026