What is the CVSS score of CVE-2026-25052?

CVE-2026-25052 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-25052?

Within 24 hours: Identify all n8n instances in your environment and document current versions. Within 7 days: Apply vendor patches (upgrade to version 1.123.18 or 2.5.0+) to all n8n deployments. Within 30 days: Conduct audit of workflow access logs to detect unauthorized file access attempts; review and restrict workflow creation permissions to essential personnel only.

N8n CVE-2026-25052

Q: Which versions of N8n are affected by CVE-2026-25052?

A critical vulnerability in n8n workflow automation platform allows authenticated users to read sensitive files from the host system, potentially exposing credentials, configuration data, and other…. A patch is available.

CRITICAL

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-02-04 security-advisories@github.com

GHSA-gfvg-qv54-r4pc

Information Disclosure AI / ML N8n

9.9

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as user with workflow creation permission
Delivery

Create or modify workflow with file access payload
Exploit

Exploit file access controls vulnerability
Execution

Read sensitive system files and credentials
Impact

Obtain user account takeover capability

Vulnerability Assessment

Weakness	CWE CWE-367 OWASP Top 10:2025 A04:2021 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions	Authenticated user account with permission to create or modify workflows on n8n instances prior to versions 1.123.18 and 2.5.0. Vulnerable file access control mechanism in workflow execution must be present.
Impact	CVSS 9.9 with patch. Second n8n critical vulnerability. Race conditions can be reliably exploited with proper timing.
Exploit ScenarioDerived	An attacker exploits the TOCTOU window to modify a workflow between its validation and execution, injecting malicious code that bypasses security checks.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

n8n has a TOCTOU race condition vulnerability (CVSS 9.9) enabling bypass of execution restrictions in workflow processing.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 9.9

TOCTOU race condition in n8n enables execution restriction bypass.

RemediationAI

Update n8n.

Affected Packages

npm n8n fix: 1.123.18, 2.5.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

n8n < 1.123.18 / 2.5.0 has a CWE-367 time-of-check time-of-use race condition that allows attackers to modify workflow execution between validation and execution phases.

Know when N8n gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Feb 05, 2026 - 20:32 nvd

Patch available

CVE Published

Feb 04, 2026 - 17:16 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of any user on the instance. This issue has been patched in versions 1.123.18 and 2.5.0.

Executive ViewAI

Why It Matters

A critical vulnerability in n8n workflow automation platform allows authenticated users to read sensitive files from the host system, potentially exposing credentials, configuration data, and other confidential information. Any organization using n8n is at immediate risk if users with workflow creation permissions are compromised or act maliciously.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not possible: restrict workflow creation permissions to highly trusted users only; implement network segmentation to limit n8n access to sensitive system files; monitor file access logs for suspicious activity; disable n8n instances not in active use.

Threat Intelligence Overview

EPSS Score

0.0%

Top 95% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +50

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.