CVE-2026-25055
📋 TL;DR
This vulnerability in n8n workflow automation platform allows attackers to write files to unintended locations on remote systems via SSH nodes, potentially leading to remote code execution. It affects n8n instances with workflows that process uploaded files and transfer them via SSH without metadata validation. Attackers need knowledge of such workflows and unauthenticated file upload endpoints.
💻 Affected Systems
- n8n
📦 What is this software?
N8n by N8n
N8n by N8n
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on remote systems connected via SSH, allowing complete compromise of those systems.
Likely Case
Unauthorized file writes to sensitive locations on remote systems, potentially leading to data exposure or system disruption.
If Mitigated
Limited impact with proper authentication on file upload endpoints and workflow validation.
🎯 Exploit Status
Exploitation requires knowledge of vulnerable workflows and unauthenticated upload endpoints. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.123.12 or 2.4.0
Vendor Advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-m82q-59gv-mcr9
Restart Required: Yes
Instructions:
1. Update n8n to version 1.123.12 (for v1.x) or 2.4.0 (for v2.x). 2. Restart the n8n service. 3. Verify workflows using SSH nodes with file transfers are functioning correctly.
🔧 Temporary Workarounds
Require authentication on file upload endpoints
allEnsure all endpoints accepting file uploads require proper authentication
Disable or restrict SSH node usage
allTemporarily disable workflows using SSH nodes for file transfers
🧯 If You Can't Patch
- Implement strict authentication on all file upload endpoints
- Audit and disable workflows using SSH nodes for file transfers without proper validation
🔍 How to Verify
Check if Vulnerable:
Check n8n version and review workflows for SSH nodes processing uploaded filesCheck Version:
n8n --version or check package.json versionVerify Fix Applied:
Confirm n8n version is 1.123.12 or higher (v1.x) or 2.4.0 or higher (v2.x)📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- SSH node errors with file operations
- Unauthenticated access to upload endpoints
Network Indicators:
- Unexpected SSH connections from n8n server
- File transfers to unusual locations
SIEM Query:
source="n8n" AND (event="file_upload" OR event="ssh_transfer") AND status="success" AND user="unauthenticated"