Workflow Automation Giant n8n Exposed: Critical Flaw Opens Door to Code Execution on 100,000+ Servers
Subtitle: A severe vulnerability in n8n's automation platform leaves thousands of organizations worldwide at risk of full compromise.
When software designed to automate your business turns into a ticking time bomb, the fallout can be catastrophic. That’s the stark reality facing users of n8n, a popular workflow automation platform whose newly discovered vulnerability-scoring a near-maximum 9.9 on the CVSS scale-could hand attackers the keys to the digital kingdom. With over 100,000 potentially exposed instances, the scale of this threat is as vast as it is urgent.
The Anatomy of a High-Severity Flaw
First disclosed by n8n maintainers and tracked as CVE-2025-68613, this flaw lurks in the heart of the software’s workflow configuration engine. Under specific conditions, expressions provided by authenticated users are evaluated in a context that’s not properly isolated from the underlying runtime. This technical oversight lets an attacker escalate their privileges, executing arbitrary code under the n8n process itself.
In plain English: anyone with an n8n login-malicious insider or compromised account-could potentially hijack the server, access sensitive data, rewrite workflows, or even run system-level commands. The impact? Anything from data breaches to ransomware attacks, all facilitated by a single, critical oversight.
Global Exposure: Who’s at Risk?
The numbers are staggering. According to Censys, over 103,000 n8n instances are exposed online, with the highest concentrations in the United States, Germany, France, Brazil, and Singapore. Given n8n’s popularity in automating business processes, from data pipelines to customer support, the potential for widespread exploitation is real-and imminent.
The vulnerable versions span all releases from 0.211.0 up to but not including 1.120.4. Patches have been rushed out in versions 1.120.4, 1.121.1, and 1.122.0, but unless administrators act quickly, countless systems remain low-hanging fruit for cybercriminals.
Mitigation and the Road Ahead
The advice from security experts is unequivocal: patch now. Where immediate updates are impossible, organizations should restrict who can create or edit workflows and isolate n8n deployments from untrusted networks. As automation platforms become ever more embedded in business operations, this incident is a sobering reminder that convenience and security must advance hand in hand.
WIKICROOK
- CVSS: CVSS (Common Vulnerability Scoring System) is a standard method for rating the severity of security flaws, with scores from 0.0 to 10.0.
- Arbitrary Code Execution: Arbitrary Code Execution lets attackers run any code on a system, often leading to full control, data theft, or malware installation.
- Workflow Automation Platform: A Workflow Automation Platform automates security tasks and processes, minimizing manual work, reducing errors, and improving cybersecurity efficiency.
- Authenticated User: An authenticated user is someone who has logged in to a system and has verified access, but may not have full permissions or control.
- Patch: A patch is a software update released to fix security vulnerabilities or bugs in programs, helping protect devices from cyber threats and improve stability.
