PT-2026-28090 · N8N · N8N
Published
2026-03-25
·
Updated
2026-03-26
·
CVE-2026-33749
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 1.123.27
n8n versions prior to 2.13.3
n8n versions prior to 2.14.1
Description
n8n is a workflow automation platform. An authenticated user with appropriate permissions could create a workflow that generates HTML binary data without a filename. The
/rest/binary-data endpoint serves these responses inline without the necessary Content-Disposition or Content-Security-Policy headers. This allows the HTML to render in the browser with full same-origin JavaScript access. An attacker could send the resulting URL to a higher-privileged user, potentially executing JavaScript in the victim’s session, leading to workflow and credential exfiltration, workflow modification, or privilege escalation to administrator level. The issue involves the exploitation of the /rest/binary-data endpoint and the manipulation of binary data objects. The username and password of authenticated users could be compromised.Recommendations
Upgrade to n8n version 1.123.27 or later.
Upgrade to n8n version 2.13.3 or later.
Upgrade to n8n version 2.14.1 or later.
If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only.
If upgrading is not immediately possible, restrict network access to the n8n instance.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
N8N