n8n CVE-2026-118648

Requires an authenticated n8n member with permission to create AND activate workflows (PR:L), plus a victim who opens the attacker's webhook URL (UI:A). The concrete trigger is a webhook response served through a path that omits n8n's sandbox Content-Security-Policy - specifically error responses and some responses without headers, including nodes operating in legacy response mode. Limiting factors: exploitation is not useful against a single-user/trusted instance (the dangerous case is shared or multi-tenant deployments where another, possibly higher-privileged, user opens the webhook URL); it needs the victim's interaction and a member-level account, so it is not remote-unauthenticated. The script executes on the n8n origin and acts with the session of whoever opens the URL.

This is a credible this-week-priority issue rather than an inflated high-CVSS score, but it is explicitly not a remote-unauthenticated catastrophe. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N) encodes exactly the gating factors that matter: network reach and low complexity, but privileges required (PR:L - the attacker must be an authenticated n8n member able to create and activate workflows) and active user interaction (UI:A - a victim must open the malicious webhook URL). The vulncheck Decision label is 'this_week', consistent with high confidentiality/integrity impact against the n8n origin via session riding. No CISA KEV listing is present in the input, no EPSS score was supplied, and no public exploit or PoC reference is provided (the two references are the GHSA and vulncheck advisories, not exploit code), so there is no evidence of active exploitation - treat the threat as plausible-but-unproven, driven by the stored/persistent nature of the XSS rather than mass exploitation. The main tension to flag: the impact ceiling depends on who opens the webhook URL (self-XSS-like unless a higher-privileged user is lured into opening an attacker-controlled webhook), so real-world severity hinges on multi-tenant/shared-instance deployments where a low-privilege member can reach other users' sessions.

On a shared or multi-tenant n8n instance, a low-privileged but authenticated member creates and activates a workflow whose webhook returns HTML through a response path that omits the sandbox CSP - for example an error response or a legacy-mode response without headers. The member sends the webhook URL to another user; when that user opens it, the injected script executes on the n8n origin and acts with the victim's authenticated session. No public exploit code is identified at time of analysis.