🚨New N8N Vulnerability Disclosed 🚨 Rotate your Encryption Key ASAP
This morning, multiple cyber security firms report a new vulnerability affecting N8N, it is listed as CVE-2026-25049. I know a lot of people here use N8N and I’m providing this as a public service announcement. According to Pillar Security, exploiting CVE-2026-25049 enables complete compromise of the n8n instance and could be leveraged to run arbitrary system commands on the server, steal all stored credentials, secrets (API keys, OAuth tokens), and sensitive configuration files. By exploiting the vulnerability, the researchers were also able to access the filesystem and internal systems, pivot to connected cloud accounts, and hijack AI workflows (intercept prompts, modify responses, redirect traffic). Bleeping Computer notes: n8n users should update the platform to the most recent version (currently 1.123.17 and 2.5.2). Pillar security also recommends rotating the ‘N8N_ENCRYPTION_KEY’ and all credentials stored on the server, and reviewing workflows for suspicious expressions. CVE-2026-25049 enables any authenticated n8n user with workflow-editing permissions to escape the JavaScript sandbox via incomplete AST-based sanitization, resulting in unrestricted RCE and access to all stored credentials, API keys, and connected cloud accounts. The flaws bypass the prior patch for CVE-2025-68613 via a type confusion vulnerability in property access key validation, with public PoC exploits now available and GreyNoise reporting 33,000+ probing requests against exposed n8n endpoints. Organizations should immediately update to n8n versions 2.5.2 or 1.123.17, rotate the N8N_ENCRYPTION_KEY and all stored credentials, and restrict workflow editing to trusted users only. Cross posting this information to multiple different, SKOOL communities today to ensure the widest dissemination.