CVE-2026-118648 in n8n
Summary
by MITRE • 10/28/2026
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in versions of n8n prior to 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 represents a significant security flaw rooted in the improper implementation of Content Security Policy headers within webhook response handling mechanisms. This issue is classified as a stored cross-site scripting vulnerability, which falls under the Common Weakness Enumeration category CWE-79: Improper Neutralization of Input During Web Page Generation. The core technical failure occurs when specific webhook response paths, particularly those involving error responses or responses that lack explicit headers, fail to include the sandbox Content-Security-Policy directive. By omitting this critical security header, the application inadvertently allows the browser to execute scripts without the restrictions typically imposed by a strict CSP configuration.
The operational impact of this vulnerability is severe because it enables authenticated users who possess the ability to create and activate workflows to inject malicious HTML content into webhook responses. When an unauthenticated or differently authenticated user opens a URL associated with such a compromised workflow, their browser executes the injected scripts within the context of the n8n origin. This effectively bypasses same-origin policy protections, allowing the attacker's scripts to act with the full session privileges of the victim user. Consequently, this can lead to unauthorized access to sensitive data, manipulation of application state, or further exploitation of other vulnerabilities present in the n8n interface that rely on user authentication and session integrity.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically within the context of web-based attacks where scripts are used to perform actions on behalf of the victim. The stored nature of the XSS means that the malicious payload is persisted in the application's workflow definitions rather than being delivered via a one-time link, increasing the likelihood of successful exploitation against multiple victims over time. Attackers can leverage this capability to steal session cookies, capture credentials entered into forms within the n8n interface, or perform actions such as modifying workflows and triggering automations without authorization.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is to upgrade n8n to version 1.123.85 or later for the 1.x branch, version 2.43.5 or later for the 2.x series excluding the affected 2.44.x range, or specifically version 2.44.1 and above for the 2.44 line. For organizations unable to upgrade immediately, implementing a reverse proxy such as Nginx or Apache can provide an additional layer of defense by enforcing Content-Security-Policy headers at the infrastructure level regardless of how the backend application handles them. This ensures that all responses, including error pages and those missing internal header configurations, are still subject to strict security policies. Additionally, administrators should audit existing workflows for any custom code or webhook integrations that might be susceptible to similar issues and ensure that input validation is robust across all user-facing endpoints.