Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

n8n could let attackers run unwanted workflows

published 9 days ago
Summary

The n8n automation tool contains a weakness that could let a malicious user start or change workflows without permission. The problem is fixed in versions released after 2.28.0-r4. Upgrade n8n to the latest version as soon as possible to protect your automations.

What to do
  • Update cleanstart n8n to version 2.28.0-r4.
  • Update n8n to version 2.28.0-r4.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart n8n < 2.28.0-r4
Fix: upgrade to 2.28.0-r4
CleanStart – n8n < 2.28.0-r4
Fix: upgrade to 2.28.0-r4
Original advisory text
Security fix for GHSA-m5w8-4gq2-6f8x applied in: n8n 2.28.0-r4
Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Timeline
Published10 Oct 2026
Updated15 Oct 2026
First seen10 Oct 2026
Sources
CLEANSTART-2026-EQ29985 · OSV
Track software like this
Free during beta