●PocketClawAI security alerts
Sign in
mediumCVSS 5.4NVD status: Analyzed

CVE-2026-25051

n8n is an open source workflow automation platform.

Componentn8n
Severitymedium (CVSS 5.4)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published (NVD)2026-02-04
Last modified2026-06-17
Affected versions
n8n < 1.123.2
Fixed in1.123.2
WeaknessCWE-79
CISA KEVnot listed

NVD description

n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in version 1.123.2.

Does CVE-2026-25051 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for n8n.
Check my stack

What to do

  • Upgrade n8n to 1.123.2 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other n8n CVEs

high
CVE-2026-103247CVSS 8.5

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper gua...

n8n
2026-10-01high
CVE-2026-103249CVSS 7.6

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerabilit...

n8n
2026-10-01critical
CVE-2026-103255CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase...

n8n
2026-10-01high
CVE-2026-103246CVSS 7.7

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attac...

n8n
2026-10-01critical
CVE-2026-103248CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supaba...

n8n
2026-10-01high
CVE-2026-103250CVSS 8.1

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB...

n8n
2026-10-01

All n8n CVEs