PT-2026-28074 · N8N · N8N

C0Rydoras + 3 · Published 2026-03-25 · Updated 2026-04-05 · CVE-2026-33660

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.14.1 n8n versions prior to 2.13.3 n8n versions prior to 1.123.26

Description n8n is a workflow automation platform. A user authenticated with permissions to create or modify workflows could leverage the "Combine by SQL" mode within the Merge node to read local files on the n8n host and potentially achieve remote code execution. The AlaSQL sandbox lacked sufficient restrictions on certain SQL statements, enabling an attacker to access sensitive files on the server or compromise the instance. The vulnerable component is the Merge node and its use of AlaSQL.

Recommendations Upgrade to n8n version 2.14.1 or later. Upgrade to n8n version 2.13.3 or later. Upgrade to n8n version 1.123.26 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, disable the Merge node by adding n8n-nodes-base.merge to the NODES EXCLUDE environment variable.

Exploit

Fix

RCE

Code Injection

SQL injection

Weakness Enumeration

CWE-94

CWE-89

Related Identifiers

CVE-2026-33660

GHSA-58QR-RCGV-642V

Affected Products

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33660.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-58qr-rcgv-642v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33660 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33660 · Security Note
• https://osv.dev/vulnerability/GHSA-58qr-rcgv-642v · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/0dayPublishing/status/2036860482569515013 · Twitter Post
• https://twitter.com/CVEnew/status/2036911822587174921 · Twitter Post
• https://twitter.com/pulsepatchio/status/2037184955911200933 · Twitter Post
• https://twitter.com/integ_sec/status/2040765160181092580 · Twitter Post
• https://twitter.com/qualys/status/2039342262719582246 · Twitter Post