Executive brief
n8n is a workflow automation platform that allows users to create and execute automated tasks. An authenticated user with workflow creation permissions can exploit the JavaScript Task Runner to access uninitialized memory buffers, potentially exposing sensitive data such as API tokens, secrets, and previous request data that reside in the same process. This vulnerability requires the Task Runner feature to be enabled and can lead to the disclosure of confidential information.
Technical details
The vulnerability is a use-of-uninitialized-memory issue (CWE-908) in n8n's JavaScript Task Runner component. An authenticated user with permission to create or modify workflows can allocate uninitialized memory buffers through the Task Runner, which may contain residual data from the Node.js process including secrets, tokens, and prior request data. The attack vector is network-based with low attack complexity and requires low privileges (authenticated user account). In-process runner mode is required for the vulnerability to be fully exploitable; external runner mode limits exposure to the external runner process only. Patches are available in versions 1.123.22, 2.10.1, and 2.9.3.
Affected products
- n8n n8n All versions before 1.123.22, all versions 2.0.0-rc.0 to before 2.9.3, and versions 2.10.0
Timeline
- 2026-03-25: disclosed
- 2026-03-25: patched: Fixed in versions 1.123.22, 2.10.1, and 2.9.3