LDAP Node Vulnerability in n8n Workflow Automation Platform
CVE-2026-33751

6.3MEDIUM

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
25 March 2026

What is CVE-2026-33751?

The n8n workflow automation platform has a vulnerability in its LDAP node's filter escape logic. This flaw allows LDAP metacharacters in user-controlled input to be processed without proper escaping, potentially enabling an attacker to manipulate LDAP search filters. If exploited, this may lead to unauthorized access to LDAP records or authentication bypass in specific workflow configurations where external input is passed into LDAP node search parameters. To mitigate this issue, users are advised to upgrade to versions 1.123.27, 2.13.3, or 2.14.1. Temporary measures include restricting workflow permissions, disabling the LDAP node, and avoiding unvalidated user input in search parameters.

Affected Version(s)

n8n < 1.123.27 < 1.123.27

n8n >= 2.0.0-rc.0, < 2.13.3 < 2.0.0-rc.0, 2.13.3

n8n = 2.14.0 = 2.14.0

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-w8...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.