CVE-2026-25052
Published: 04 February 2026
Summary
CVE-2026-25052 is a critical-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in N8N N8N. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25052 is a critical vulnerability in the file access controls of n8n, an open source workflow automation platform. Affecting versions prior to 1.123.18 and 2.5.0, the flaw enables authenticated users to read sensitive files from the n8n host system. It has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition) and NVD-CWE-Other.
An attacker with an authenticated account and permission to create or modify workflows can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By leveraging the flawed controls, they can access critical configuration data and user credentials stored on the host, potentially achieving complete account takeover of any user on the n8n instance, including administrators.
The official advisory from the n8n GitHub Security Advisories (GHSA-gfvg-qv54-r4pc) confirms that the issue has been addressed in versions 1.123.18 and 2.5.0, recommending immediate upgrades to these or later releases for mitigation. No additional workarounds are specified in the provided details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5419
Vulnerability details
n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system.…
more
This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of any user on the instance. This issue has been patched in versions 1.123.18 and 2.5.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln in public-facing n8n workflow app (TOCTOU file access flaw) directly enables remote exploitation of the application for arbitrary local file reads (T1190), facilitating collection of data/credentials from the host filesystem (T1005) including explicit unsecured credential files (T1552.001) leading to account takeover.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved access authorizations for system resources, directly addressing the flawed file access controls exploited to read sensitive host files.
SI-2 requires timely remediation of flaws through patching, such as upgrading to n8n versions 1.123.18 or 2.5.0 that fix the file access vulnerability.
AC-6 enforces least privilege, limiting workflow create/modify permissions to prevent excessive access enabling sensitive file reads.