Critical · published February 4, 2026
🔥 An authenticated user can read sensitive files just by being able to create or modify workflows! This is a big deal for n8n users! Think of it like a restaurant where a cook can rummage through the pantry and find everyone's secret recipes— if they know how to navigate the kitchen. In this case, your workflows give users far more access than intended. This vulnerability is absolutely devastating! An attacker could snag sensitive configuration data and user credentials, paving the way for complete account takeover. That means they could impersonate any user, wreaking havoc on your entire system!
Think of it like a restaurant where a cook can rummage through the pantry and find everyone's secret recipes— if they know how to navigate the kitchen. In this case, your workflows give users far more access than intended. This flaw in n8n's file access controls allows authenticated users with workflow permissions to access sensitive files on the host system, exposing critical data that should be secured.
This vulnerability is absolutely devastating! An attacker could snag sensitive configuration data and user credentials, paving the way for complete account takeover. That means they could impersonate any user, wreaking havoc on your entire system! To protect your instance, immediately update n8n to versions 1.123.18 or 2.5.0. Also, review user permissions to ensure only trusted individuals can create or modify workflows. Regularly audit your configurations to safeguard sensitive data. You've got this! With these steps, you'll be back in control of your n8n environment in no time! 🛡️