PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54301 n8n-io CVE debrief

CVE-2026-54301 is a high-severity vulnerability in n8n, an open-source workflow automation platform. An authenticated user with workflow edit access could serve binary content with an attacker-controlled Content-Type using a Respond to Webhook node. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user's session. This vulnerability is fixed in versions 1.123.55, 2.25.7, and 2.26.2. Users should update to these versions to mitigate the risk. The vulnerability has a CVSS score of 7 and is considered high severity.

Vendor
n8n-io
Product
n8n
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-26
Advisory published
2026-06-23
Advisory updated
2026-06-26

Who should care

Users of the n8n workflow automation platform should be aware of this vulnerability if they have workflow edit access or use public webhooks. System administrators and security teams responsible for n8n instances should prioritize patching to prevent potential code execution.

Technical summary

The vulnerability exists in the Respond to Webhook node of the n8n platform. An authenticated user with workflow edit access can configure the node to serve binary content with a user-controlled Content-Type header. When a public webhook is triggered and visited by an authenticated user, the bypassed Content-Security-Policy sandbox allows JavaScript execution in the n8n origin, granting access to the user's session. The issue is addressed in versions 1.123.55, 2.25.7, and 2.26.2.

Defensive priority

High priority should be given to updating n8n instances to versions 1.123.55, 2.25.7, or 2.26.2. In the meantime, restricting workflow edit access and closely monitoring public webhook usage and user activity can help mitigate the risk.

Recommended defensive actions

  • Update n8n to version 1.123.55, 2.25.7, or 2.26.2.
  • Restrict workflow edit access to trusted users.
  • Monitor public webhook usage and user activity.
  • Implement additional security measures such as IP restrictions for webhooks.
  • Regularly review and audit workflows for suspicious configurations.

Evidence notes

The CVE-2026-54301 vulnerability details were obtained from the NVD database and the n8n security advisory. The vulnerability is considered high severity with a CVSS score of 7. Fixes are available in versions 1.123.55, 2.25.7, and 2.26.2. Users should verify their instance versions and update as necessary.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54301 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54301

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54301 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54301

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.