PT-2026-28078 · N8N · N8N

34Selen + 3 · Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-33665

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.4.0 n8n versions prior to 1.121.0

Description n8n is a workflow automation platform. When Lightweight Directory Access Protocol (LDAP) authentication is enabled, n8n automatically links an LDAP identity to an existing local account if the LDAP email attribute matches the local account's email. An authenticated LDAP user who can control their LDAP email attribute can set it to match another user's email, including an administrator's, and gain full access to that account upon login. The account linkage persists even if the LDAP email is reverted, resulting in a permanent account takeover. LDAP authentication must be configured and active for this to occur.

Recommendations Upgrade to n8n version 2.4.0 or later. Upgrade to n8n version 1.121.0 or later. If upgrading is not immediately possible, disable LDAP authentication until the instance can be upgraded. If upgrading is not immediately possible, restrict LDAP directory permissions so that users cannot modify their own email attributes. If upgrading is not immediately possible, audit existing LDAP-linked accounts for unexpected account associations.

Exploit

Fix

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-33665

GHSA-C545-X2RH-82FC

Affected Products

N8N

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33665.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-c545-x2rh-82fc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33665 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c545-x2rh-82fc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33665 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/cyberbivash/status/2036886289442574532 · Twitter Post
• https://twitter.com/CVEnew/status/2036911820125200593 · Twitter Post