Critical Remote Code Execution in n8n Workflow Automation (CVE‑2025‑68613) Actively Exploited, 24,700 Instances Exposed
What It Is – A critical expression‑injection flaw in the open‑source workflow platform n8n allows an attacker to execute arbitrary code on the host running the service. The vulnerability is tracked as CVE‑2025‑68613 with a CVSS 9.9 rating.
Exploitability – The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed the bug in its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Public proof‑of‑concepts and exploit kits have been observed targeting unpatched deployments.
Affected Products – n8n (self‑hosted and cloud‑hosted instances) across all versions prior to the 0.225.0 patch released in February 2026.
TPRM Impact – Organizations that rely on n8n for automated data movement, integration, or orchestration face a supply‑chain risk: a compromised n8n instance can be leveraged to exfiltrate data, pivot to connected SaaS services, or disrupt critical business processes.
Recommended Actions –
- Deploy the official n8n 0.225.0 (or later) patch immediately on all environments.
- Conduct a rapid inventory to identify any n8n instances still running pre‑patch versions.
- Isolate unpatched systems from production networks and enforce strict outbound filtering.
- Enable comprehensive logging and monitor for anomalous process execution or outbound connections from n8n nodes.
- Review third‑party risk policies to include workflow‑automation platforms and require regular patch compliance.
Source: The Hacker News – CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed