Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances
24.12.2025
4372
Critical n8n flaw CVE-2025-68613 (CVSS 9.9) lets authenticated users run arbitrary code; versions 0.211.0–1.120.4 affected, patched in newer releases.
🚨 CRITICAL ALERT: n8n Workflow Automation Tool Has a CVSS 9.9 Flaw That Lets Hackers Run ANY Code They Want
Yikes. If you're using n8n for workflow automation, listen up. There's a critical vulnerability (CVE-2025-68613) with a CVSS score of 9.9 — basically one step away from total system takeover.
Here's the deal: ANY authenticated user can exploit this flaw to execute arbitrary code on the server. We're talking full remote code execution (RCE) capabilities. This isn't some theoretical risk — it's live and dangerous.
Affected versions: EVERYTHING from 0.211.0 through 1.120.4. That's a massive range covering thousands of installations. n8n is open-source workflow automation that's become super popular for connecting APIs and automating tasks — think Zapier but self-hosted.
- • Vulnerability ID: CVE-2025-68613
- • CVSS Score: 9.9 (CRITICAL)
- • Attack Vector: Network
- • Attack Complexity: Low
- • Privileges Required: Low (authenticated user)
- • User Interaction: None
- • Scope: Changed
- • Confidentiality Impact: High
- • Integrity Impact: High
- • Availability Impact: High
The patch is already out in newer releases. If you're running n8n, you NEED to update immediately. This isn't optional — we're talking about a vulnerability that could let attackers completely compromise your automation infrastructure.
What makes this extra spicy: n8n is often used in sensitive automation workflows, connecting to databases, APIs, cloud services. A compromise here could mean attackers get access to ALL your connected systems. Not good.
Bottom line: Patch NOW. Check your n8n version. If it's between 0.211.0 and 1.120.4, you're vulnerable. Update to the latest version immediately. This is one of those 'drop everything and fix it' vulnerabilities.
#n8n#RCE vulnerabilities#security patches#CVE vulnerabilities#vulnerability exploitation
Got a topic? Write to ATLA WIRE on Telegram:t.me/atla_community
