{"id":15755,"date":"2026-02-06T20:56:32","date_gmt":"2026-02-06T20:56:32","guid":{"rendered":"https:\/\/newestek.com\/?p=15755"},"modified":"2026-02-06T20:56:32","modified_gmt":"2026-02-06T20:56:32","slug":"six-more-vulnerabilities-found-in-n8n-automation-platform","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=15755","title":{"rendered":"Six more vulnerabilities found in n8n automation platform"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Six more vulnerabilities have been discovered in the n8n workflow platform used for building LLM-powered agents to connect business processes. Four of the six are rated as critical, carrying CVSS severity scores of 9.4.<\/p>\n

\u201cThese vulnerabilities span multiple attack classes, from remote code execution and command injection to arbitrary file access and cross-site scripting, all targeting a platform that is frequently deployed with access to secrets, credentials, internal APIs, and business-critical logic,\u201d noted Amit Genkin<\/a>, a security researchers at Israel-based cloud security provider Upwind, who blogged about the vulnerabilities this week<\/a>.<\/p>\n

Johannes Ullrich<\/a>, dean of research at the SANS Institute, said the vulnerabilities affect how n8n sandboxes the processes created by different users, and how the host is protected from users with access to n8n.<\/p>\n

\u201cThis is less of an issue for a single user system,\u201d he said in an email, \u201cbut n8n is often installed in shared environments. Given the number and severity of the vulnerabilities, it is fair to assume that this is more or less just the \u2018tip of the iceberg\u2019. At this point, multi user n8n deployments should be treated with care.\u201d<\/p>\n

The discovery is the second major revelation of issues in the n8n platform this year. Four weeks ago, researchers at Cyera published details of a critical vulnerability<\/a>, after it had been patched, that would allow unauthenticated attackers to completely take over n8n deployments.<\/p>\n

Also last month, it was learned that threat actors are targeting n8n<\/a> by planting malicious packages on the npm registry that claim to be legitimate n8n add-ons.<\/p>\n

CSOs with n8n in their environments and developers using the platform should update to the latest version of the application to close the newly-found holes.<\/p>\n

The vulnerabilities are:<\/p>\n