Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances
Summary: A critical vulnerability in the n8n workflow automation platform, tracked as CVE-2025-68613, carries a CVSS score of 9.9 and could allow an authenticated attacker to execute arbitrary code with the privileges of the n8n process. The flaw affects versions from 0.211.0 up to but not including 1.120.4, has been patched in 1.120.4, 1.121.1, and 1.122.0, and Censys counted 103,476 potentially vulnerable instances as of December 22, 2025.
Why it matters: More than 100,000 n8n instances were exposed as of December 22, 2025, concentrated in the U.S., Germany, France, Brazil, and Singapore, and successful exploitation can mean full compromise of the instance, including sensitive data access and system-level operations.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-68613
- Related
- CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability Known Exploited Vulnerabilities · Mar 11, 2026