P3Verified

CVE-2025-68668: n8n from 1.0.0 (inclusive), before 2.0.0 (exclusive), >= 1.0.0, < 2.0.0

CVE-2025-68668. CVSS 3.1 base score 9.9 (CRITICAL, NVD). EPSS 0.13167 (percentile 0.96288), scored 12-Oct-2026.

Affected technology

n8n · from 1.0.0 (inclusive), before 2.0.0 (exclusive)
n8n

n8n · >= 1.0.0, < 2.0.0
n8n-io

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality and integrity impact as high; availability impact as low. NVD’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality, integrity and availability impact as high.

Published 13-Oct-2026 13:57 UTC

CWE: CWE-693
CCR priority: 42.9 /100 (P3)
CVSS 3.1: 9.9 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · NVD
EPSS: 0.13167 · percentile 0.96288 · 2026-10-12
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-13 13:56:14.349801+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-68668.html