Executive brief
n8n is a workflow automation platform that allows users to create and run integrations via webhooks and form endpoints. A vulnerability in versions 1.65.0 through 1.120.x allows unauthenticated attackers to access arbitrary files on the server through malicious form-based workflows, potentially exposing sensitive data and enabling further system compromise depending on how the platform is deployed.
Technical details
The vulnerability stems from improper input validation (CWE-20) in n8n's webhook and form request handling, affecting versions 1.65.0 through 1.120.x. An unauthenticated remote attacker can exploit this via network access to craft malicious form-based workflows that bypass authentication checks and allow unauthorized file access on the underlying server. The attack requires no user interaction and can result in exposure of sensitive information and potential system compromise. The vulnerability was patched in version 1.121.0; no official workarounds exist, though temporarily restricting or disabling public webhook and form endpoints can serve as a mitigation strategy.
Affected products
- n8n n8n 1.65.0 to 1.120.x
Timeline
- 2026-01-07: disclosed: Vulnerability published on GitHub advisory database
- 2026-01-07: patched: Fix released in n8n version 1.121.0