CVE-2025-68613

n8n lets users build “automation workflows” using expressions. This vulnerability allows a logged-in user to sneak in a crafted expression that tricks n8n into running attacker-controlled code on the machine where n8n runs. In practice, that can mean the person can get the same power as your n8n server—steal or change workflows, and disrupt operations.

This matters if you run n8n on your server (or a host you manage) and users can log in to create or edit workflows. The issue requires an authenticated user, so it’s most likely to be a risk from an attacker who already has access to your n8n account (or a user account you don’t fully trust). It’s not just “internet scanning”—it’s a risk when the vulnerable n8n version is in use and someone can reach the workflow expression feature through an authenticated session.

This is RED because CISA has confirmed it in the KEV catalog, meaning it’s been seen in the real world and defenders should act as if it’s exploitable now. The attacker path is practical: an authenticated user can inject malicious expressions during workflow work, which can lead to full server compromise.

1. Confirm exposure (what you should check)

   • Identify the exact n8n version running in production.
   • Determine whether it is prior to the fixed releases: 1.120.4, 1.121.1, or 1.122.0.
   • Confirm you have users who can create or edit workflows (this is the required condition: authenticated access).

2. Upgrade remediation (preferred)

   • Upgrade n8n to one of the fixed versions: 1.120.4, 1.121.1, or 1.122.0.
   • Use your normal release/maintenance process, and schedule a change window if needed.

3. Temporary mitigations if upgrade is delayed (short-term)

   • Limit workflow creation and editing permissions to only fully trusted users.
   • Run n8n in a hardened environment with restricted operating system privileges and restricted network access, to reduce the impact if code execution occurs.
   • Treat these as stopgaps; they do not fully remove the risk.

4. Post-upgrade verification and incident hygiene

   • Review recent workflow changes and user activity around the time of any suspicious events.
   • Verify no unauthorized workflows, unexpected expression changes, or abnormal scheduling/execution behavior exist.
   • Ensure access controls for n8n remain tight (only necessary users, strong authentication, and least-privilege where possible).

5. Timing guidance

   • CISA KEV remediation due date: 2026-03-25.

Severity is critical with a remote code execution impact on the host running n8n. The weakness is CWE-913, exploited via expression injection in n8n’s workflow expression evaluation system.

Key conditions from the findings: authenticated access is required; the vulnerable versions are those prior to 1.120.4, 1.121.1, or 1.122.0; and the injected expressions can be evaluated in a context insufficiently isolated from the runtime, allowing arbitrary code execution with the privileges of the n8n process.

Exploitation status: CISA KEV is marked as YES and lists a remediation due date of 2026-03-25, which indicates real-world concern and drives a RED priority. Exploit maturity in the findings is supported by KEV; press reporting does not provide a clear dated claim. EPSS is present in the findings as a prediction, but public blocks should not rely on it when KEV indicates a confirmed real-world seriousness.