Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

n8n workflow tool could allow unauthorized code execution

CVE-2026-54309 · published 13 days ago
Summary

The n8n automation platform has a security weakness that could let an attacker run code on your system. Updated versions have been released that fix the problem. Install the latest n8n release as soon as possible to protect your environment.

What to do
  • Update GitHub Actions n8n to version 2.26.2.
  • Update GitHub Actions n8n to version 2.25.7.
  • Update GitHub Actions n8n to version 2.19.3-aikido.2.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.2.
  • Update GitHub Actions n8n to version 2.19.3-aikido.3.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.3.
  • Update GitHub Actions n8n to version 2.19.3-aikido.4.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.4.
  • Update GitHub Actions n8n to version 2.19.3-aikido.5.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.5.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.6.
  • Update GitHub Actions n8n to version 2.19.3-aikido.6.
  • Update n8n to version 2.19.3-aikido.9.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.9.
  • Update n8n to version 2.19.3-aikido.10.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.10.
  • Update n8n to version 2.19.3-aikido.12.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.12.
  • Update n8n to version 2.19.3-aikido.13.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.13.
  • Update n8n to version 2.19.3-aikido.14.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.14.
  • Update n8n to version 2.19.3-aikido.15.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.15.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions n8n >= 2.26.0, < 2.26.2
< 2.25.7
Fix: upgrade to 2.26.2
Root:npm GitHub Actions n8n < 2.19.3-aikido.2
< 2.19.3-aikido.3
< 2.19.3-aikido.4
< 2.19.3-aikido.5
< 2.19.3-aikido.6
Fix: upgrade to 2.19.3-aikido.2
Root:npm rootio @rootio/n8n < 2.19.3-root.io.2
< 2.19.3-root.io.3
< 2.19.3-root.io.4
< 2.19.3-root.io.5
< 2.19.3-root.io.6
< 2.19.3-root.io.9
< 2.19.3-root.io.10
< 2.19.3-root.io.12
< 2.19.3-root.io.13
< 2.19.3-root.io.14
< 2.19.3-root.io.15
Fix: upgrade to 2.19.3-root.io.2
– n8n n8n < 2.25.7
>= 2.26.0, < 2.26.2
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
Root:npm – n8n < 2.19.3-aikido.9
< 2.19.3-aikido.10
< 2.19.3-aikido.12
< 2.19.3-aikido.13
< 2.19.3-aikido.14
< 2.19.3-aikido.15
Fix: upgrade to 2.19.3-aikido.9
Original advisory text
CVE-2026-54309 in n8n - Patched by Root
Root has patched CVE-2026-54309 in the n8n package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen17 Jun 2026
Sources
GHSA-qrx8-25qr-5r7v · GHSA
CVE-2026-54309 · NVD
GHSA-qrx8-25qr-5r7v · OSV
ROOT-APP-NPM-CVE-2026-54309 · OSV
Track software like this
Free during beta