N8N · N8N · CVE-2026-33665
**Name of the Vulnerable Software and Affected Versions**
n8n versions prior to 2.4.0
n8n versions prior to 1.121.0
**Description**
n8n is a workflow automation platform. When Lightweight Directory Access Protocol (LDAP) authentication is enabled, n8n automatically links an LDAP identity to an existing local account if the LDAP email attribute matches the local account's email. An authenticated LDAP user who can control their LDAP email attribute can set it to match another user's email, including an administrator's, and gain full access to that account upon login. The account linkage persists even if the LDAP email is reverted, resulting in a permanent account takeover. LDAP authentication must be configured and active for this to occur.
**Recommendations**
Upgrade to n8n version 2.4.0 or later.
Upgrade to n8n version 1.121.0 or later.
If upgrading is not immediately possible, disable LDAP authentication until the instance can be upgraded.
If upgrading is not immediately possible, restrict LDAP directory permissions so that users cannot modify their own email attributes.
If upgrading is not immediately possible, audit existing LDAP-linked accounts for unexpected account associations.