n8n EUVD-2026-63270

Exploitation requires an authenticated n8n user account with privileges to create or modify workflows - this is a standard user capability in n8n, not limited to administrators. The specifically vulnerable feature is the Filter node or Switch node when configured to use user-supplied regular expression patterns, which is their intended normal operation. The attacker must be able to save a crafted regex to a workflow node and trigger that workflow's execution against input data. Exploitation is bounded by: (1) authenticated access (PR:L per CVSS 4.0 vector - unauthenticated external attackers cannot reach the vulnerable code path); (2) possession of workflow create or edit permissions; (3) ability to trigger workflow execution. Non-default conditions are not required - regex-based Filter and Switch nodes are a core, default-enabled feature. The primary limiting factor is the authentication and workflow-authoring privilege requirement.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) places this as a moderate-severity availability issue requiring low-privileged authenticated access with no additional complexity. There is no confidentiality or integrity impact and no subsequent-system impact, confining the damage to worker-thread availability within the vulnerable n8n instance. No EPSS score was supplied in the provided intelligence; exploitation probability cannot be independently quantified here. CISA KEV status is unconfirmed - no active exploitation evidence exists in the supplied data. The real-world priority is context-dependent: multi-tenant or shared n8n deployments where untrusted users can author workflows face meaningful risk, because workflow editing is a standard user capability rather than an admin-only function. Single-operator or tightly access-controlled deployments where all workflow authors are trusted face substantially lower risk despite the network-accessible vector. The per-item amplification is the most operationally significant factor - a single malicious workflow processing a large dataset can sustain prolonged worker blockage, cascading delays to unrelated workflow executions sharing that worker.

An authenticated n8n user with workflow editing access creates a Filter node containing a catastrophic backtracking regex such as ^(a+)+$ and triggers the workflow against a dataset of non-matching strings. Each item causes the synchronous regex evaluation on the worker thread to enter exponential backtracking, monopolizing the worker for seconds or minutes per item and stalling all other workflow executions scheduled on that worker. No public proof-of-concept has been identified, but the attack pattern is trivially constructable from well-documented ReDoS literature.