Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-25052 is a critical-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in N8N N8N. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25052 is a critical vulnerability in the file access controls of n8n, an open source workflow automation platform. Affecting versions prior to 1.123.18 and 2.5.0, the flaw enables authenticated users to read sensitive files from the n8n host system. It has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition) and NVD-CWE-Other.
An attacker with an authenticated account and permission to create or modify workflows can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By leveraging the flawed controls, they can access critical configuration data and user credentials stored on the host, potentially achieving complete account takeover of any user on the n8n instance, including administrators.
The official advisory from the n8n GitHub Security Advisories (GHSA-gfvg-qv54-r4pc) confirms that the issue has been addressed in versions 1.123.18 and 2.5.0, recommending immediate upgrades to these or later releases for mitigation. No additional workarounds are specified in the provided details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5419
Vulnerability Data
n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system.…
more
This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of any user on the instance. This issue has been patched in versions 1.123.18 and 2.5.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2V17.2.6
Mitigating Controls (NIST 800-53 r5) AI
A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.
Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.
Process isolation limits the blast radius of a successful TOCTOU exploitation but does not remove the race itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.