🎯There's a flaw in n8n that lets bad actors sneak in harmful code, putting users at risk. This flaw is also being used to send fake emails that can deliver malware. It's important to update n8n and keep an eye on your systems to stay safe.
What Happened
A new vulnerability has been discovered in the n8n automation platform, putting users at risk of serious attacks. Researchers from Imperva found that a weakness in the configuration of OAuth credentials allows for a stored XSS (Cross-Site Scripting) vulnerability. This means that malicious actors could potentially inject harmful JavaScript code that gets saved and executed for any user interacting with the compromised credentials.
n8n is designed to streamline tasks by connecting to various services like Google Workspace, Microsoft 365, and Slack without exposing sensitive passwords. By using OAuth tokens and API keys, it simplifies workflows, allowing users to automate processes. However, the way n8n handles authorization URLs is problematic; it fails to properly sanitize these URLs, making it easy for attackers to exploit this vulnerability.
Additionally, recent findings by Cisco Talos indicate that threat actors have been misusing n8n for sophisticated phishing campaigns, leveraging its automation capabilities to deliver malware and perform device fingerprinting. This highlights a significant risk associated with the OAuth flaw, as it could be exploited to facilitate these malicious activities.
Why Should You Care
If you use n8n, this vulnerability could have severe implications for your organization. Imagine if an attacker could access your n8n system and exfiltrate sensitive credentials across your team. This would not only compromise your n8n environment but could also lead to broader security breaches across interconnected services. Automation platforms like n8n centralize access to multiple systems, making them prime targets for attackers.
The risk is heightened because these platforms are increasingly integral to modern IT infrastructures. They save time and improve efficiency, but they also centralize trust. A vulnerability in such a critical layer can be far more damaging than one in an isolated application. You need to treat your automation tools as essential assets and ensure they are secured properly.
What's Being Done
In response to the discovered vulnerability, n8n has released a patch in version 2.6.4, which was made available on February 6. This update addresses the flaw and is part of their regular release cycle, which often includes silent patches for vulnerabilities. Here’s what you should do if you’re using n8n:
- Update to the latest version (v2.6.4) immediately to ensure you have the fix.
- Review access controls to your n8n system and enforce strict permissions.
- Monitor your environment for any unusual activity that may indicate exploitation.
Experts are now watching for any potential follow-up attacks that could leverage this vulnerability, especially given the platform's growing popularity and the recent history of other vulnerabilities. The increase in phishing emails using n8n's webhook features, which rose by approximately 686% from January 2025 to March 2026, underscores the urgency of addressing this flaw to prevent further exploitation.
Immediate Actions
To mitigate risks associated with this vulnerability and the potential for malware delivery, organizations should: The ongoing evolution of automation platforms necessitates vigilance and proactive security measures to protect against their misuse.
Containment
- 1.Implement behavioral detection mechanisms to identify unusual traffic patterns directed at n8n.
- 2.Share indicators of compromise (IOCs) with cybersecurity platforms to enhance collective defense strategies.
Remediation
As automation platforms like n8n become more integral to business workflows, their vulnerabilities can be exploited to facilitate sophisticated attacks. Organizations must prioritize security measures to protect these critical tools.
