A critical remote code execution (RCE) vulnerability has been discovered in n8n, a widely used workflow automation platform, leaving over 103,000 exposed instances at immediate risk of compromise.
Vulnerability Overview
The vulnerability, tracked as CVE-2025-68613, carries a severe CVSS score of 9.9, indicating near-maximum criticality.
The flaw resides in n8n’s workflow expression evaluation system, where authenticated users can inject and execute arbitrary code by exploiting insufficient isolation in the runtime execution context.
Successful exploitation grants attackers complete control of affected instances, enabling unauthorized data access, workflow manipulation, and system-level operations.
The vulnerability affects n8n versions starting from 0.211.0 through multiple release branches, including versions prior to 1.120.4, 1.121.1, and 1.122.0.
Publicly disclosed on December 19, 2025, the vulnerability has already attracted significant attention from researchers, with proof-of-concept (PoC) code published by SecureLayer7.
Scale and Impact
Security researchers at Censys have identified approximately 103,476 potentially vulnerable n8n instances accessible across the internet.
This widespread exposure represents a substantial attack surface for threat actors targeting organizations reliant on n8n for critical business processes.
The automation platform’s adoption across enterprises means compromised instances could facilitate lateral movement, data exfiltration, and supply chain attacks.
n8n has released patched versions addressing the vulnerability: 1.120.4, 1.121.1, and 1.122.0. Organizations running vulnerable versions should upgrade immediately to eliminate exploitation risk.
The vendor emphasizes urgent patching due to the vulnerability’s severity and the public availability of working PoC code.
For organizations unable to deploy patches immediately, n8n recommends interim security measures: restrict workflow creation and editing permissions to trusted personnel only, and deploy n8n in hardened environments with minimal operating system privileges and restricted network access.
However, these workarounds provide incomplete protection and should be used only as temporary measures until patches are deployed.
At the time of disclosure, no active exploitation in the wild has been documented. However, given the vulnerability’s critical severity, public PoC availability, and the massive number of exposed instances, organizations face urgent pressure to patch before threat actors systematize attacks.
Organizations operating n8n should treat this vulnerability as a priority-zero incident. Immediate patching is essential.
Security teams should inventory internal n8n deployments, verify current versions, and execute upgrades across all affected systems.
The combination of high criticality, ease of exploitation for authenticated users, and widespread vulnerable deployments creates an exceptionally dangerous situation that requires a rapid response.
Organizations can query Censys Platform or ASM solutions to identify potentially vulnerable n8n instances within their infrastructure and track remediation progress.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The vulnerability, tracked as CVE-2025-68613, carries a severe CVSS score of 9.9, indicating near-maximum criticality.){kind=link}