Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

n8n can let attackers run code on your server

CVE-2026-54305 · published 13 days ago
Summary

The n8n workflow automation tool, including the versions used in GitHub Actions and the @rootio package, has a flaw that could let an attacker execute their own code on the system where n8n runs. This could lead to data loss, system compromise, or other unwanted actions. Install the latest patched version of n8n as soon as possible to close the gap.

What to do
  • Update GitHub Actions n8n to version 1.123.55.
  • Update GitHub Actions n8n to version 2.26.2.
  • Update GitHub Actions n8n to version 2.25.7.
  • Update GitHub Actions n8n to version 2.19.3-aikido.2.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.2.
  • Update GitHub Actions n8n to version 2.19.3-aikido.3.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.3.
  • Update GitHub Actions n8n to version 2.19.3-aikido.4.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.4.
  • Update GitHub Actions n8n to version 2.19.3-aikido.5.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.5.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.6.
  • Update GitHub Actions n8n to version 2.19.3-aikido.6.
  • Update n8n to version 2.19.3-aikido.9.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.9.
  • Update n8n to version 2.19.3-aikido.10.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.10.
  • Update n8n to version 2.19.3-aikido.11.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.11.
  • Update n8n to version 2.19.3-aikido.12.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.12.
  • Update n8n to version 2.19.3-aikido.13.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.13.
  • Update n8n to version 2.19.3-aikido.14.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.14.
  • Update n8n to version 2.19.3-aikido.15.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.15.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions n8n < 1.123.55
>= 2.26.0, < 2.26.2
>= 2.0.0-rc.0, < 2.25.7
Fix: upgrade to 1.123.55
Root:npm GitHub Actions n8n < 2.19.3-aikido.2
< 2.19.3-aikido.3
< 2.19.3-aikido.4
< 2.19.3-aikido.5
< 2.19.3-aikido.6
Fix: upgrade to 2.19.3-aikido.2
Root:npm rootio @rootio/n8n < 2.19.3-root.io.2
< 2.19.3-root.io.3
< 2.19.3-root.io.4
< 2.19.3-root.io.5
< 2.19.3-root.io.6
< 2.19.3-root.io.9
< 2.19.3-root.io.10
< 2.19.3-root.io.11
< 2.19.3-root.io.12
< 2.19.3-root.io.13
< 2.19.3-root.io.14
< 2.19.3-root.io.15
Fix: upgrade to 2.19.3-root.io.2
– n8n n8n < 1.123.55
>= 2.0.0, < 2.25.7
>= 2.26.0, < 2.26.2
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
Root:npm – n8n < 2.19.3-aikido.9
< 2.19.3-aikido.10
< 2.19.3-aikido.11
< 2.19.3-aikido.12
< 2.19.3-aikido.13
< 2.19.3-aikido.14
< 2.19.3-aikido.15
Fix: upgrade to 2.19.3-aikido.9
Original advisory text
CVE-2026-54305 in n8n - Patched by Root
Root has patched CVE-2026-54305 in the n8n package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-284Improper Access Control
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen17 Jun 2026
Sources
ROOT-APP-NPM-CVE-2026-54305 · OSV
GHSA-2j5h-858j-5mpf · GHSA
CVE-2026-54305 · NVD
GHSA-2j5h-858j-5mpf · OSV
Track software like this
Free during beta