Executive brief
n8n is an automation platform used to connect different software services and automate business workflows. A security flaw allowed users with workflow editing permissions to create malicious webhooks that could execute unauthorized code in another user's browser session. If a victim visits a specially crafted webhook link, an attacker could potentially hijack their session and gain access to sensitive account data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in n8n's 'Respond to Webhook' node. An authenticated attacker with workflow edit permissions can configure a node to return binary content with a custom 'Content-Type' header. This specific response path fails to apply the standard Content-Security-Policy (CSP) sandbox headers. When an authenticated victim visits the resulting public webhook URL, the attacker-controlled payload executes JavaScript within the n8n origin. This allows the attacker to access the victim's session tokens and perform actions on their behalf. The issue is resolved in versions 1.123.55, 2.25.7, and 2.26.2.
Affected products
- n8n-io n8n < 1.123.55, >= 2.0.0-rc.0 < 2.25.7, >= 2.26.0 < 2.26.2
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published by vendor
- 2026-06-23: disclosed: NVD publication date