Security Flaw in n8n Workflow Automation Platform

CVE-2026-33749

What is CVE-2026-33749?

The n8n workflow automation platform has a security vulnerability that allows an authenticated user to create an unsafe workflow. This vulnerability arises when an attacker can craft a workflow that produces an HTML binary data object without a filename, which is served inline without proper security headers like 'Content-Disposition' and 'Content-Security-Policy'. This lack of protection allows malicious JavaScript to be executed in the context of a victim's session, potentially leading to the exfiltration of sensitive data, unauthorized modifications of workflows, and privilege escalation to admin-level access. To protect against this issue, users are urged to upgrade to n8n versions 1.123.27, 2.13.3, or 2.14.1. Until an upgrade is feasible, limiting permissions for workflow creation and editing to trusted users and restricting network access to the n8n instance are advised as temporary mitigation measures.

References