Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-54310: n8n workflow automation could let attackers run code
CVE-2026-54310 · published 13 days ago
Summary
The n8n automation software, including its GitHub Actions and Root.io packages, had a security weakness that could allow a malicious user to run arbitrary code on your system. This could lead to data loss or compromise of other connected services. Apply the latest patched version of n8n as soon as possible to close the gap.
What to do
- Update GitHub Actions n8n to version 2.26.2.
- Update GitHub Actions n8n to version 2.25.7.
- Update GitHub Actions n8n to version 2.19.3-aikido.5.
- Update rootio @rootio/n8n to version 2.19.3-root.io.5.
- Update rootio @rootio/n8n to version 2.19.3-root.io.6.
- Update GitHub Actions n8n to version 2.19.3-aikido.6.
- Update n8n to version 2.19.3-aikido.9.
- Update rootio @rootio/n8n to version 2.19.3-root.io.9.
- Update n8n to version 2.19.3-aikido.10.
- Update rootio @rootio/n8n to version 2.19.3-root.io.10.
- Update n8n to version 2.19.3-aikido.11.
- Update rootio @rootio/n8n to version 2.19.3-root.io.11.
- Update n8n to version 2.19.3-aikido.12.
- Update rootio @rootio/n8n to version 2.19.3-root.io.12.
- Update n8n to version 2.19.3-aikido.13.
- Update rootio @rootio/n8n to version 2.19.3-root.io.13.
- Update n8n to version 2.19.3-aikido.14.
- Update rootio @rootio/n8n to version 2.19.3-root.io.14.
- Update n8n to version 2.19.3-aikido.15.
- Update rootio @rootio/n8n to version 2.19.3-root.io.15.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | n8n |
>= 2.26.0, < 2.26.2 < 2.25.7 Fix: upgrade to 2.26.2
|
| Root:npm | GitHub Actions | n8n |
< 2.19.3-aikido.5 < 2.19.3-aikido.6 Fix: upgrade to 2.19.3-aikido.5
|
| Root:npm | rootio | @rootio/n8n |
< 2.19.3-root.io.5 < 2.19.3-root.io.6 < 2.19.3-root.io.9 < 2.19.3-root.io.10 < 2.19.3-root.io.11 < 2.19.3-root.io.12 < 2.19.3-root.io.13 < 2.19.3-root.io.14 < 2.19.3-root.io.15 Fix: upgrade to 2.19.3-root.io.5
|
| – | n8n | n8n |
< 2.25.7 >= 2.26.0, < 2.26.2 cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* |
| Root:npm | – | n8n |
< 2.19.3-aikido.9 < 2.19.3-aikido.10 < 2.19.3-aikido.11 < 2.19.3-aikido.12 < 2.19.3-aikido.13 < 2.19.3-aikido.14 < 2.19.3-aikido.15 Fix: upgrade to 2.19.3-aikido.9
|
Original advisory text
CVE-2026-54310 in n8n - Patched by Root
Root has patched CVE-2026-54310 in the n8n package for Root:npm. Multiple fixed versions available.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp Mitigation Vendor Advisory
- https://github.com/advisories/GHSA-c37g-w77q-m4vp
- https://github.com/n8n-io/n8n Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-54310 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-89SQL Injection
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen16 Jun 2026
Track software like this
Free during beta