CVE-2026-54301 Details
Description
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user's session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.
A cross-site scripting vulnerability has been identified in n8n, an open-source workflow automation platform, affecting versions prior to 1.123.55, 2.25.7, and 2.26.2. The issue arises when an authenticated user with workflow edit access configures a 'Respond to Webhook' node to send binary content with a user-defined Content-Type. This binary response bypasses the application's Content-Security-Policy sandbox header, enabling a public webhook to execute JavaScript in the n8n origin. The vulnerability is triggered when the webhook is accessed by an authenticated user, who then has access to that user's session.
Users can upgrade to n8n versions 1.123.55, 2.25.7, or 2.26.2 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to limit workflow creation and editing permissions to trusted users only, or to disable the 'Respond to Webhook' node by adding 'n8n-nodes-base.respondToWebhook' to the 'NODES_EXCLUDE' environment variable.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.55 >= 2.0.0, < 2.25.7 >= 2.26.0, < 2.26.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |