Critical Remote Code Execution in n8n Workflow Automation (CVE‑2025‑68613) Added to CISA KEV Catalog
What It Is – A critical Remote Code Execution (RCE) flaw (CVE‑2025‑68613) in the n8n workflow‑automation platform allows authenticated users to execute arbitrary code during workflow expression evaluation. The vulnerability scores a perfect 10.0 on the CVSS v3.1 scale.
Exploitability – Actively exploited in the wild; the flaw is now listed in the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog. Proof‑of‑concept code and real‑world exploitation have been observed.
Affected Products – n8n (all versions prior to 1.120.4, 1.121.1, and 1.122.0). The platform is widely used for automating business processes, integrating over 400 third‑party services, and is often self‑hosted on customer premises or cloud environments.
TPRM Impact – The vulnerability can be leveraged to compromise any organization that relies on n8n for internal or partner workflows, exposing sensitive data, tampering with business logic, and providing a foothold for lateral movement across the supply chain.
Recommended Actions –
- Immediately upgrade n n8n to version 1.120.4, 1.121.1, or 1.122.0.
- If patching cannot be performed promptly, restrict workflow creation and editing to fully trusted, privileged accounts only.
- Deploy n8n in a hardened, isolated runtime (e.g., container sandbox, minimal privileges, network segmentation).
- Conduct an inventory of all n8n instances (including SaaS‑hosted and on‑prem) and verify patch status.
- Review logs for anomalous expression evaluations and possible post‑exploitation activity.
Source: Security Affairs – CISA adds n8n flaw to KEV catalog