Active Exploitation of n8n Workflow Automation (CVE‑2025‑68613) Added to CISA KEV Catalog
What It Is – A critical improper control of dynamically‑managed code resources in the open‑source workflow automation platform n8n (CVE‑2025‑68613). The flaw allows an attacker to execute arbitrary code on the host running n8n, potentially compromising any integrated services.
Exploitability – Confirmed active exploitation in the wild; CISA has placed the CVE in its Known Exploited Vulnerabilities (KEV) Catalog. No public proof‑of‑concept is required for exploitation.
Affected Products – n8n (self‑hosted and cloud‑hosted deployments) versions prior to the vendor‑released patch (see n8n security advisory).
TPRM Impact – Organizations that rely on n8n for internal or customer‑facing workflows inherit the risk of remote code execution, which can cascade to downstream SaaS integrations, data pipelines, and API endpoints. A compromised n8n instance can become a foothold for supply‑chain attacks against partners and customers.
Recommended Actions –
- Prioritize patching n8n to the latest version that addresses CVE‑2025‑68613.
- If immediate patching is not possible, apply temporary mitigations: restrict network access to n8n instances, enforce strict IAM roles, and disable untrusted custom code nodes.
- Conduct a rapid inventory of all third‑party services that consume n8n workflows; verify they are not exposed to the vulnerable instance.
- Update vulnerability management programs to treat KEV entries as “high‑priority” remediation items per CISA BOD 22‑01.
Source: CISA Advisory – 2026‑03‑11