n8n CVE-2026-110849

Exploitation requires (1) the attacker to hold authenticated member-level access to the n8n instance (PR:L) with the ability to upload binary data items, and (2) a higher-privileged victim - typically the instance owner - to actively open the attacker's uploaded file in the file-preview modal (UI:A / AT:P). The specific technical trigger is the file-preview modal re-publishing uploaded binary data as an unsandboxed, same-origin blob URL, so the flaw is reachable only through that preview feature. Limiting factors: no exploitation is possible without a valid member account, the owner must choose to preview the crafted item, and single-user or fully-trusted-team instances (where no untrusted member can upload) are not realistically exposed. Versions at or above 1.123.83, 2.41.4, or 2.42.1 are patched.

This is a stored XSS (CWE-79) in n8n's file-preview modal rated CVSS 4.0 7.2 (High). The input CVSS 4.0 vector shows network attack vector (AV:N) but low attack complexity (AC:L) offset by a present attack requirement (AT:P) and active user interaction (UI:A) - meaning exploitation is not fire-and-forget: a privileged victim (the owner) must actually open the preview of an attacker-uploaded item. PR:L confirms the attacker must be an authenticated low-privilege member of the instance, so this is an insider/tenant-to-owner privilege-escalation style issue rather than remote-unauthenticated mass exploitation. Impact is high on confidentiality and integrity (VC:H/VI:H) because script runs in the n8n same-origin context and can act with the victim's session, but availability is unaffected (VA:N) and there is no subsequent-system scope change claimed in the input vector (SC:N/SI:N). No EPSS score, no CISA KEV listing, and no POC were provided in the intelligence, so this is not confirmed as actively exploited; the practical risk is elevated for multi-tenant/shared n8n deployments where untrusted members can upload binary data, and lower for single-user or trusted-team instances. In short: a genuinely serious same-origin account-takeover vector in shared environments, but gated by member-level access plus owner interaction, so it is a prioritize-if-multi-tenant issue rather than an internet-wide drive-by.

A low-privileged member of a shared n8n instance uploads a crafted binary item whose content is re-published by the file-preview modal as an unsandboxed same-origin blob URL. When the instance owner opens that file in the preview modal, attacker-controlled script executes in the n8n origin and can hijack the owner's session, exfiltrate credentials/workflow secrets, or perform actions as the owner. No public exploit identified at time of analysis, and the attack requires the victim to actively open the preview (UI:A).