CVE-2026-25049 is a critical flaw (CVSS 9.9 in the NVD record) in n8n, the workflow automation platform. A user who can create or edit workflows can abuse crafted expressions to run system commands on the host. n8n 1.123.17 and 2.5.2 fix it. Upgrade, and limit who can edit workflows until you have.
What's affected
- Affected: n8n before 1.123.17 on the 1.x line, and before 2.5.2 on the 2.x line.
- Fixed in: 1.123.17 and 2.5.2.
- Who can trigger it: an authenticated user with permission to create or modify workflows.
The advisory says these are additional exploits in n8n's expression evaluation, found and patched after CVE-2025-68613. n8n has adopted CVSS 4.0 as its primary score and lists 9.4 for this advisory. The NVD record carries a CVSS 3.1 score of 9.9, with changed scope, which is why you may see both numbers.
How to check if you're exposed
Find your n8n version. In the web interface, the version appears in the settings or help menu. For a container or a package, check the tag or the installed package.
docker ps --format '{{.Image}}' | grep n8n
npm ls -g n8n
Then ask who has the permission to create or edit workflows. On a single user instance run by one trusted person, the practical risk is lower than on a shared instance used by a team, a client portal or a community. Count the accounts. Remove any that no longer need access.
Next, consider what the n8n process can reach. The advisory mentions deploying n8n in a hardened environment with restricted operating system privileges and network access. Check which credentials, files and internal networks the host exposes to that process.
What to do now
- Upgrade n8n to 1.123.17 or later on 1.x, or to 2.5.2 or later on 2.x.
- Until the upgrade is done, limit workflow creation and editing to fully trusted users. This is the advisory's first workaround.
- Run n8n with restricted operating system privileges and limited network access. This is the advisory's second workaround.
- Remember that both workarounds are described as short term. The advisory says they do not fully remediate the risk.
- Review recent workflow changes, and look for workflows nobody can explain.
- Rotate secrets stored in n8n credentials if you have reason to think an account was misused.
Why it matters
n8n workflows are programs. Expressions let a workflow author compute values at run time, and the platform has to keep those expressions away from the underlying host. When that boundary has holes, the people allowed to author workflows can reach the operating system. The advisory describes it as unintended system command execution.
The weakness is filed as CWE-913 (Improper Control of Dynamically-Managed Code Resources), improper control of dynamically managed code resources. That class covers systems that evaluate dynamic content and fail to restrict what it can reach. An earlier advisory in the same area is a clear signal. When one fix in an expression engine is followed by another, expect more, and treat the engine as a part of your attack surface.
Automation hosts also hold credentials for many other services. A command execution flaw there reaches well beyond one server. Keep credentials scoped to what each workflow needs, and keep the host's own permissions small.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can an anonymous visitor exploit CVE-2026-25049?
No. The advisory says the user must be authenticated and have permission to create or modify workflows. That still matters on any instance with several editors.
Is it exploited in the wild?
The record does not list it on the CISA Known Exploited Vulnerabilities catalog, and the advisory does not say it has been exploited.
Do the workarounds replace the upgrade?
No. The advisory says they do not fully remediate the risk and should only be short term measures.
Sources
Last reviewed: 19 October 2026.
