Security readout for executives and security teams
Plain-English summary
CVE-2025-68613 is a critical n8n flaw where a logged-in user who can configure workflows may cause n8n to run code on the server. This can expose credentials, data, workflows, and the host environment. Organizations using self-hosted n8n should treat affected instances as high priority, especially where many users can edit workflows.
Executive priority
Prioritize remediation immediately for any affected production or internet-accessible n8n instance. The business risk is server compromise through a legitimate account, with potential access to automation secrets and connected systems. If upgrading cannot happen promptly, restrict workflow editing and reduce runtime privileges as temporary risk reduction.
Technical view
Affected n8n versions from 0.211.0 before 1.120.4 and 1.121.0 have insufficient isolation in workflow expression evaluation. The CVSS 3.1 score is 10.0: network reachable, low complexity, authenticated privileges required, no user interaction, scope changed, and high confidentiality, integrity, and availability impact. The issue is associated with CWE-913 and is fixed in 1.120.4, 1.121.1, and 1.122.0.
Likely exposure
Exposure is likely for self-hosted n8n deployments running affected versions where authenticated users can create or edit workflows. Risk is higher when n8n holds sensitive credentials, reaches internal systems, or runs with broad operating-system privileges. The source bundle does not identify additional affected products beyond n8n.
Exploitation context
The vulnerability requires an authenticated attacker with workflow configuration capability. The provided data says CISA KEV is false, so active exploitation is not established here. A referenced Akamai article indicates threat interest in n8n, but the bundle does not prove exploitation of this specific CVE.
Researcher notes
Do not assume unauthenticated exploitation; the described path requires authenticated workflow configuration access. The key validation questions are version, user permissions, runtime privilege, and network reachability. Vendor advisory and commits are the authoritative sources for fixed versions and implementation changes. Evidence provided does not establish KEV-listed exploitation.
Mitigation direction
- Upgrade n8n to 1.120.4, 1.121.1, 1.122.0, or a later fixed release.
- Restrict workflow creation and editing to fully trusted users until upgraded.
- Run n8n with least-privilege operating-system permissions.
- Limit n8n network access to only required internal and external services.
- Review vendor guidance for branch-specific upgrade instructions.
- Rotate sensitive credentials if compromise is suspected.
Validation and detection
- Inventory all n8n instances, including containers and self-hosted servers.
- Confirm each instance version is not in the affected ranges.
- Review which users can create or edit workflows.
- Check whether n8n runs with excessive host or network privileges.
- Review workflow and access logs for suspicious authenticated changes.
- Verify upgraded instances report a fixed version.
Public sources used
- CVE Program
- CVE List V5
- GitHub Security Advisory GHSA-v98v-ff95-f3cp
- n8n commit 08f332015153decdda3c37ad4fcb9f7ba13a7c79
- n8n commit 1c933358acef527ff61466e53268b41a04be1000
- n8n commit 39a2d1d60edde89674ca96dcbb3eb076ffff6316
- Akamai security research reference
- CISA Known Exploited Vulnerabilities Catalog query
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-913: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-68613 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cpCVE reference · x_refsource_CONFIRM
- https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79CVE reference · x_refsource_MISC
- https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000CVE reference · x_refsource_MISC
- https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316CVE reference · x_refsource_MISC
- https://www.akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platformCVE reference · third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68613CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Dynamically-Managed Code Resources
Improper Control of Dynamically-Managed Code Resources represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.