CVE-2026-25051: n8n Improper CSP Enforcement in Webhook Responses Leading to Stored XSS
Summary
CVE-2026-25051: n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS. Affects n8n across 2 version ranges.
< 1.122.5
>= 1.123.0, < 1.123.2
Fixed in 1.122.5 or 1.123.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It provides a user-friendly interface for creating workflows that can integrate with APIs, databases, and other services. However, n8n has a vulnerability related to its Content Security Policy (CSP) enforcement, which can lead to security risks if not addressed.
Vulnerability Detail
A Cross-site Scripting (XSS) vulnerability exists in n8n's handling of webhook responses and related HTTP endpoints. The issue arises when the Content Security Policy (CSP) sandbox protection fails to apply correctly under certain conditions. An authenticated user with permissions to create or modify workflows can exploit this vulnerability to execute malicious scripts with same-origin privileges. This could lead to severe consequences, including session hijacking and account takeover, especially when other users interact with the crafted workflows.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.122.51.122.5npm install n8n@1.122.5 -
>= 1.123.0, < 1.123.21.123.2npm install n8n@1.123.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, administrators can implement the following temporary mitigations: 1. Limit workflow creation and editing permissions to fully trusted users only. 2. Avoid executing untrusted workflows. 3. Review workflows that receive data via webhooks, forms, or MCP servers to ensure they are communicating with trusted entities before executing them manually.
Conclusion
The identified vulnerability in n8n regarding improper CSP enforcement poses significant risks, including potential XSS attacks. Users are strongly encouraged to upgrade to the latest patched versions to mitigate these risks. Temporary workarounds can be applied, but they do not fully resolve the issue.
See every vulnerability recorded for n8n →
FAQ
The vulnerability is a Cross-site Scripting (XSS) issue that arises from improper enforcement of the Content Security Policy in webhook responses.
Any authenticated user of n8n who has permissions to create or modify workflows may be able to exploit this vulnerability.
Exploitation of this vulnerability could lead to session hijacking and account takeover, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
