Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

n8n could let attackers execute code

CVE-2026-65016 · published 7 days ago
Summary

Certain versions of the n8n workflow automation tool contain a flaw that could allow a malicious user to run arbitrary code on the server where it is installed. This could give an attacker control over the affected system. Install the latest patched version of n8n as soon as possible to close the risk.

What to do
  • Update GitHub Actions n8n to version 1.123.64.
  • Update GitHub Actions n8n to version 2.30.1.
  • Update GitHub Actions n8n to version 2.29.8.
  • Update n8n to version 2.19.3-aikido.11.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.11.
  • Update n8n to version 2.19.3-aikido.12.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.12.
  • Update n8n to version 2.19.3-aikido.13.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.13.
  • Update n8n to version 2.19.3-aikido.14.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.14.
  • Update n8n to version 2.19.3-aikido.15.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.15.
Affected software
Ecosystem VendorProductAffected versions
– n8n-io n8n < 1.123.64
< 2.30.1
< 2.29.8
npm GitHub Actions n8n < 1.123.64
>= 2.30.0, < 2.30.1
>= 2.0.0-rc.0, < 2.29.8
Fix: upgrade to 1.123.64
– n8n n8n < 1.123.64
>= 2.0.0, < 2.29.8
2.30.0
cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*
Root:npm – n8n < 2.19.3-aikido.11
< 2.19.3-aikido.12
< 2.19.3-aikido.13
< 2.19.3-aikido.14
< 2.19.3-aikido.15
Fix: upgrade to 2.19.3-aikido.11
Root:npm rootio @rootio/n8n < 2.19.3-root.io.11
< 2.19.3-root.io.12
< 2.19.3-root.io.13
< 2.19.3-root.io.14
< 2.19.3-root.io.15
Fix: upgrade to 2.19.3-root.io.11
Original advisory text
CVE-2026-65016 in n8n - Patched by Root
Root has patched CVE-2026-65016 in the n8n package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published6 Oct 2026
Updated11 Oct 2026
First seen22 Jul 2026
Sources
CVE-2026-65016 · NVD
CVE-2026-65016 · MITRE
GHSA-35q8-9mj6-wjmf · GHSA
GHSA-35q8-9mj6-wjmf · OSV
ROOT-APP-NPM-CVE-2026-65016 · OSV
Track software like this
Free during beta