A critical security vulnerability has been discovered in the popular workflow automation platform n8n, potentially allowing attackers to take full control of affected servers.
The flaw, tracked as CVE-2025-68613, carries an alarming CVSS score of 9.9, placing it among the most severe vulnerabilities reported this year.
What Is CVE-2025-68613?
CVE-2025-68613 is an Authenticated Remote Code Execution (RCE) vulnerability in n8n.
Due to improper handling of user-supplied expressions, authenticated users can execute arbitrary JavaScript code at the server level.
This means even low-privileged users can escalate their access and run system commands on the underlying server.
Why This Vulnerability Is Dangerous
If exploited, this vulnerability allows an attacker to:
- Execute arbitrary system commands
- Fully compromise the n8n instance
- Access stored credentials, API keys, and workflows
- Steal, modify, or delete sensitive data
- Perform lateral movement within the server or cloud environment
In short, a successful exploit can result in complete server takeover.
Scale of the Impact
Security researchers have identified more than 103,000 publicly exposed n8n instances worldwide.
A significant portion of these instances are running vulnerable versions, making them attractive targets for mass exploitation.
Given n8n’s widespread use in automation, DevOps, and integration pipelines, the real-world impact could be substantial.
Affected and Patched Versions
❌ Vulnerable Versions
n8n v0.211.0 through v1.120.3
✅ Patched / Secure Versions
v1.120.4
v1.121.1
v1.122.0 and later
Users running vulnerable versions are strongly advised to upgrade immediately.
Recommended Mitigation Steps
To reduce risk and secure your n8n environment:
Update n8n immediately to a patched version
Restrict workflow creation and editing permissions
Apply the principle of least privilege for all users
Secure exposed instances using firewalls and network rules
Monitor logs for suspicious activity
Delaying these actions significantly increases the risk of compromise.
Final Thoughts
This is not a rumor or speculative report.
CVE-2025-68613 is a confirmed, high-impact vulnerability with real-world exploitation potential.
If you rely on n8n for business automation or integrations, taking immediate action is critical to protect your infrastructure and data.
