One CVE this week scores a near-maximum 9.9 on CVSS and cuts to the center of a fast-growing category of software: workflow automation platforms that exist specifically to let users write and run their own code and logic — and are now confirmed to have been actively exploited because that same design let attackers run their own code too.
CVE-2025-68613 — n8n Improper Control of Dynamically-Managed Code Resources Vulnerability — CVSS 9.9 (Critical), added to CISA's KEV catalogue on 11 March 2026.
Why this vulnerability is structurally different from a typical RCE bug
n8n is an open-source workflow automation platform — the kind of tool organizations use to wire together APIs, databases, and business logic through visual workflows, often including custom expressions that get evaluated at runtime. NVD's description is unusually specific about the mechanism: "expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime." In other words, the vulnerability is not an unintended flaw bolted onto an otherwise-safe feature — it is a failure of the isolation boundary around a feature whose entire purpose is to let users write and execute custom logic. An authenticated attacker could abuse this to "execute arbitrary code with the privileges of the n8n process," which NVD states may lead to "full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations."
The CVSS vector for this CVE (AV:N/AC:L/PR:L/UI:N/S:C) requires low privileges — meaning any authenticated user, not necessarily an administrator — and shows a scope change (S:C), meaning the impact extends beyond the vulnerable component itself into the broader host it runs on. That combination is exactly why this scored 9.9 rather than a more modest authenticated-RCE score: low bar to reach the vulnerable code path, combined with impact that spans the entire underlying system.
Why "low-code" and "no-code" platforms carry this risk by design, not by accident
Workflow automation platforms like n8n exist to give users — often non-developers — the ability to build custom logic without writing traditional application code, frequently through expression languages that evaluate at runtime. That is a genuine, valuable capability. It is also, structurally, the same category of feature as any other dynamic code evaluation mechanism: a sandbox or isolation boundary is the only thing standing between "user configures a workflow" and "user runs arbitrary code on the host." NVD's own reference material notes security researchers at Akamai documented malware — tracked as targeting the n8n automation platform specifically — exploiting this exact weakness in the wild, underscoring that this was not merely a theoretical or research-only finding.
This risk category deserves particular attention given how rapidly workflow-automation and "AI agent" platforms have proliferated as organizations build automated pipelines connecting language models, APIs, and internal systems. A platform whose core feature is "let users write logic that runs automatically" is, by construction, one misconfigured isolation boundary away from becoming a code-execution vulnerability — and n8n's growing adoption as connective tissue between business systems and AI-driven automation makes an instance a meaningfully more attractive target than it might have been as a narrower, single-purpose tool.
What to check this week
Upgrade to n8n 1.120.4, 1.121.1, or 1.122.0 immediately — these are the specific patched versions n8n's own security advisory names as containing the fix, and any instance below these on the 0.211.0-and-later affected range remains vulnerable.
Audit who currently holds workflow creation and editing permissions, since n8n's own advisory recommends limiting this to fully trusted users as an interim mitigation — a meaningfully different access model than treating all authenticated users as equally low-risk.
Review whether your n8n deployment runs with restricted operating-system privileges and network access, following n8n's own guidance that hardening the runtime environment reduces the impact of exploitation even where upgrading is not immediately possible — while treating this as a stopgap, not a substitute for patching.
Check logs for indicators associated with the malware campaign Akamai documented targeting n8n instances, since confirmed prior exploitation means some deployments may already show signs of compromise predating the patch's availability.
Extend this audit to every internally-hosted or self-managed n8n instance across the organization, including ones stood up informally by individual teams for automation experiments — these are exactly the deployments most likely to run outdated versions outside a formal patch-management process.
A closing note on the pace of adoption outrunning the pace of security maturity
Workflow-automation platforms have grown from a niche developer tool into infrastructure connecting core business systems and emerging AI-agent pipelines in a remarkably short span. Security tooling, patch-management processes, and organizational awareness of these platforms as first-class infrastructure — deserving the same scrutiny as a database or an API gateway — has not always kept pace with how quickly they have been adopted. A 9.9 CVSS score confirmed exploited against exactly this kind of platform is a concrete signal that the category has matured enough to be a real target, whether or not an organization's internal governance has caught up to that reality yet.
How Safeguard helps
Safeguard's continuous inventory extends visibility to self-hosted automation and workflow platforms like n8n — software that frequently gets deployed by individual engineering or operations teams outside a centrally managed asset list — surfacing exactly which instances remain below the 1.120.4/1.121.1/1.122.0 patched versions so this kind of confirmed-exploited, near-maximum-severity finding does not sit unpatched in a corner of the environment nobody is tracking.
