Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.5
n8n: Malicious Flows Can Hijack User Sessions
CVE-2026-27578
GHSA-2p9h-rqjw-gm92
Summary
An attacker with permission to create workflows in n8n can inject malicious code that steals user sessions and takes over accounts. To fix this, update to n8n version 2.10.1 or later. If an update isn't possible, limit who can create workflows and temporarily disable the Webhook node to reduce the risk.
What to do
- Update GitHub Actions n8n to version 1.123.22.
- Update GitHub Actions n8n to version 2.9.3.
- Update GitHub Actions n8n to version 2.10.1.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| GitHub Actions | n8n | <= 1.123.22 | 1.123.22 |
| GitHub Actions | n8n | > 2.0.0 , <= 2.9.3 | 2.9.3 |
| GitHub Actions | n8n | > 2.10.0 , <= 2.10.1 | 2.10.1 |
| n8n | n8n | <= 1.123.22 | – |
| n8n | n8n | > 2.0.0 , <= 2.9.3 | – |
| n8n | n8n | > 2.10.0 , <= 2.10.1 | – |
Original title
n8n Vulnerable to Stored XSS via Various Nodes
Original description
## Impact
An authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different techniques on various nodes (Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node). Scripts injected by a malicious workflow execute in the browser of any user who visits the affected page, enabling session hijacking and account takeover.
## Patches
The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability.
## Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES_EXCLUDE` environment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
## Credit
Reporters:
- @ori-ron
- @Aikido-Security
- @nil340
- Pawel Bednarz from the NATO Cyber Security Centre (NCSC)
An authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different techniques on various nodes (Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node). Scripts injected by a malicious workflow execute in the browser of any user who visits the affected page, enabling session hijacking and account takeover.
## Patches
The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability.
## Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES_EXCLUDE` environment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
## Credit
Reporters:
- @ori-ron
- @Aikido-Security
- @nil340
- Pawel Bednarz from the NATO Cyber Security Centre (NCSC)
nvd CVSS3.1
5.4
nvd CVSS4.0
8.5
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
CWE-80
Basic XSS
- https://nvd.nist.gov/vuln/detail/CVE-2026-27578
- https://github.com/advisories/GHSA-2p9h-rqjw-gm92
- https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534a Patch
- https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6 Patch
- https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e Patch
- https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92 Vendor Advisory
Published: 25 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026