Which versions of N8n are affected by CVE-2026-33665?

A critical authentication bypass vulnerability in n8n allows attackers with valid LDAP credentials to hijack administrator and user accounts by modifying their email attributes, gaining permanent…. A patch is available.

Is there a public PoC exploit available for CVE-2026-33665?

Yes, a public proof-of-concept exploit is available for CVE-2026-33665. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-33665?

Within 24 hours: Audit LDAP user account email modification permissions and restrict non-administrators from changing their email attributes at the directory level; document all n8n administrator accounts. Within 7 days: Implement compensating controls (disable LDAP auto-linking, enforce manual account linkage, or isolate n8n behind additional authentication layers); conduct access review of all linked LDAP accounts for unauthorized changes. Within 30 days: Monitor vendor security advisories for patch availability; evaluate migration to alternative authentication methods (SSO without auto-linkage) or n8n alternatives if patch timeline extends beyond acceptable risk tolerance.

N8n CVE-2026-33665

Q: What is the CVSS score of CVE-2026-33665?

CVE-2026-33665 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15944 HIGH

Improper Authentication (CWE-287)

2026-03-25 GitHub_M

GHSA-c545-x2rh-82fc

Authentication Bypass N8n

8.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 30, 2026 - 14:23 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 18:01 euvd

EUVD-2026-15944

Analysis Generated

Mar 25, 2026 - 18:01 vuln.today

CVE Published

Mar 25, 2026 - 17:32 nvd

HIGH 8.8

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. Prior to versions 2.4.0 and 1.121.0, when LDAP authentication is enabled, n8n automatically linked an LDAP identity to an existing local account if the LDAP email attribute matched the local account's email. An authenticated LDAP user who could control their own LDAP email attribute could set it to match another user's email - including an administrator's - and upon login gain full access to that account. The account linkage persisted even if the LDAP email was later reverted, resulting in a permanent account takeover. LDAP authentication must be configured and active (non-default). The issue has been fixed in n8n versions 2.4.0 and 1.121.0. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Disable LDAP authentication until the instance can be upgraded, restrict LDAP directory permissions so that users cannot modify their own email attributes, and/or audit existing LDAP-linked accounts for unexpected account associations. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP email attribute to match a target account's email address, gaining full access that persists even after reverting the email change. This authentication bypass (CWE-287) affects n8n versions prior to 2.4.0 and 1.121.0 where LDAP is configured, and public exploit code exists. The vulnerability requires LDAP to be actively enabled and the attacker to control their own LDAP email attribute, creating a critical account takeover risk for administrators.

Technical ContextAI

This vulnerability affects n8n (CPE: cpe:2.3:a:n8n-io:n8n), an open-source workflow automation platform written in TypeScript. The root cause is classified as CWE-287 (Improper Authentication), specifically an insecure automatic account linking mechanism in the LDAP authentication module. When LDAP authentication is enabled, n8n performs email-based matching to link LDAP identities with existing local accounts without proper validation or authorization checks. This trust boundary violation allows authenticated LDAP users to manipulate their directory email attribute to impersonate other users, bypassing intended authentication controls and establishing persistent unauthorized account associations.

RemediationAI

Upgrade n8n to version 2.4.0 or 1.121.0 or later to fully remediate this vulnerability, as detailed in the GitHub security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-c545-x2rh-82fc. If immediate patching is not feasible, implement temporary mitigations including disabling LDAP authentication entirely until upgrade is possible, restricting LDAP directory permissions to prevent users from modifying their own email attributes, and conducting a comprehensive audit of existing LDAP-linked accounts to identify and remediate any unexpected or unauthorized account associations. Note that these workarounds provide only partial risk reduction and should be considered short-term measures only.