Critical n8n Vulnerabilities Allow Code Execution and SQL Injection
Summary
CERT-Bund published security advisory WID-SEC-2026-1251 identifying critical vulnerabilities in n8n workflow automation software (CVSS Base Score 9.9). Multiple versions prior to 1.123.32, 1.123.33, 2.17.4, 2.17.5, 2.18.0, and 2.18.1 are affected across Windows, UNIX, and other operating systems. An attacker can exploit these flaws to execute arbitrary code, bypass security controls, disclose confidential information, perform SQL injection attacks, cause denial-of-service conditions, execute cross-site-scripting attacks, redirect users to malicious websites, or hijack sessions. Mitigation measures are available.
“Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, SQL-Injection-Angriffe durchzuführen, einen Denial-of-Service-Zustand verursachen, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder Sitzungen zu kapern.”
Organizations running n8n should immediately verify installed versions against the affected version list (all versions prior to 1.123.32, 1.123.33, 2.17.4, 2.17.5, 2.18.0, and 2.18.1) and apply available security patches without delay. Given the remote exploitability and high CVSS score, affected deployments should be treated as high-priority remediation items regardless of whether they are internet-facing.
About this source
CERT-Bund is the German federal cybersecurity agency's incident response team, run by the BSI. Their advisory feed publishes vulnerability disclosures and active exploitation warnings for software in widespread enterprise use: VPN appliances, email servers, file transfer products, ERP systems, browsers, hypervisors. Around 280 advisories a month, each with a CVSS score, affected versions, and remediation guidance. The advisories are written in German but cover the same vulnerabilities that show up in CISA, NCSC-UK, and JPCERT bulletins, often hours earlier. Watch this if you patch enterprise software, run a SOC, or write detection rules. GovPing publishes each advisory with the affected vendor, CVSS score, and original CERT-Bund link.
What changed
CERT-Bund issued security advisory WID-SEC-2026-1251 disclosing multiple critical vulnerabilities in n8n workflow automation software, including arbitrary code execution, SQL injection, cross-site scripting, and session hijacking. Affected versions span both major release branches (1.x and 2.x) across Windows, UNIX, and other operating systems. Organizations running n8n deployments should immediately inventory their installed versions and apply available patches to prevent remote exploitation. The CVSS Base Score of 9.9 indicates these vulnerabilities pose critical risk and should be prioritized in patch management processes.
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1251] n8n: Mehrere Schwachstellen CVSS Base Score 9.9 (kritisch) CVSS Temporal Score 8.6 (hoch) Remoteangriff ja Datum 22.04.2026 Stand 23.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Sonstiges
- UNIX
- Windows
Produktbeschreibung
n8n ist ein Workflow-Automatisierungstool, mit dem verschiedene Anwendungen und Dienste miteinander verbunden werden können, um Aufgaben zu automatisieren.
Produkte
22.04.2026
- n8n n8n <1.123.32
n8n n8n <2.18.1
n8n n8n <2.17.4
n8n n8n <1.123.33
n8n n8n <2.18.0
n8n n8n <2.17.5
Angriff
Angriff
Ein Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, SQL-Injection-Angriffe durchzuführen, einen Denial-of-Service-Zustand verursachen, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder Sitzungen zu kapern. CVE Informationen Versionshistorie Feedback zum Advisory geben
Parties
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.