al-ice.ai

n8n’s 16-Advisory Security Batch Reaches the Expression Sandbox, Credentials, and MCP

AI CVEs by al-ice.ai Editorial

n8n published a coordinated set of 16 security advisories on July 22: ten rated High and six Medium. The batch is unusually important because it does not describe one repeated parser bug. It crosses the platform’s expression evaluator, workflow authorization, credential handling, Git and image nodes, task-runner isolation, database integrations, MCP client, and computer-use file search.

The most direct path to host compromise is GHSA-gv7g-jm28-cr3m: an authenticated user allowed to create or modify workflows could craft an arrow-function expression that escaped the expression sandbox and executed system commands as the n8n process. A separate Git-node advisory allowed workflow creators to stage a local repository whose Git hooks executed commands under default Git security settings.

Operators should treat 2.32.1 or later as the safest common remediation floor for the complete published set. Many advisories also name 1.123.67 and 2.31.5 as fixed builds on their respective lines, but support differs by issue, and the token-exchange advisory’s prose names only 2.32.1. Confirm the fixed version against every enabled feature before remaining on an older branch.

Three failures turn workflow editing into host authority

The expression escape collapses the intended boundary between formula-like workflow logic and the host OS. The Git path reaches the same result through an external trusted program: the node prepares a repository, then Git executes hooks. The third host-facing primitive, GHSA-xmc9-4f2h-jf9c, passed an unvalidated Edit Image output format to the underlying image library, allowing an authenticated workflow runner to write arbitrary files outside the node’s working directory.

Another Git-node flaw, GHSA-gf29-4f56-r2jf, let fetch, pull, and push-tags operations point an allowlisted remote configuration at a local repository outside the intended path boundary. The result was local source and history disclosure rather than code execution, but it demonstrates the same structural problem: checking some operations in a multipurpose tool does not contain the operations that were omitted.

These are authenticated paths, not anonymous internet RCEs. That qualification lowers exposure for single-user deployments, but it does not make a shared automation service safe. Workflow editors routinely receive access precisely because the platform is intended to delegate automation. If that role can become the n8n OS user, the practical trust boundary is the host—not the workflow or project.

Credential restrictions failed at resolution time

Three High-severity advisories target how n8n decides which secret a workflow may use and where it may send it:

  • GHSA-6qc9-mqvw-jg7x: an HTTP Request node could specify genericAuthType through an expression. The permission check compared the unresolved expression instead of the credential type selected at runtime, allowing a shared-workflow editor who knew a credential ID to use or exfiltrate a credential they did not own.
  • GHSA-cj9h-qx8g-pq2g: credential checks covered a node’s top-level credentials but not references nested in inline Execute Sub-workflow JSON. An editor could resolve another credential in the parent workflow’s project context.
  • GHSA-64xh-79j6-r5v8: several AI and LLM nodes ignored the credential’s “Allowed HTTP Request Domains” restriction when a user supplied a base or endpoint URL. A use-only credential could therefore be transmitted to an attacker-controlled host.

The common lesson is that authorization must evaluate the fully resolved execution plan. Validating an expression string, a parent node, or a default endpoint before runtime transformation leaves an exploitable gap between what policy approved and what the worker actually executes. This is the same design pressure behind placing agent controls immediately before tool execution.

A fourth High advisory, GHSA-8342-988q-86cr, affects instances using token-exchange embed login. n8n matched a validly signed token to a local account by email without enforcing the trusted key’s role ceiling or requiring a verified email claim. Under the advisory’s stated preconditions, a token accepted from a configured trusted source could map to an existing higher-privilege account.

MCP and computer-use controls were inside the bypassed layer

GHSA-vhf8-cg2h-cg3p says the MCP Client node bypassed n8n’s SSRF protection for a user-supplied endpoint and did not pin the resolved address. A workflow editor could make the server connect to internal or otherwise blocked hosts and return responses through the workflow. This is a medium-rated authenticated issue, but the reachable targets can include cloud metadata and internal control planes unless network egress blocks them independently.

In GHSA-pf2q-pxhf-hgmw, a crafted pattern escaped the configured base directory of @n8n/computer-use’s search_files tool. Any actor able to influence search input could receive file names and contents available to the daemon’s OS account. This is especially relevant to agent deployments: “base directory” is only a security property if canonicalization and pattern expansion are enforced below model-controlled input.

The remaining isolation advisories include cross-user poisoning of a shared JavaScript runner module cache (GHSA-9cmh-xcqm-5hqr), prototype pollution through VM expression array access (GHSA-hx4h-vr3m-45vh), and instance-wide denial of service through dot-notation fields in the Edit Fields node (GHSA-xwx6-jjhv-84p8).

Node-specific bugs extend the blast radius into connected systems

Three integration advisories show why an automation platform’s effective privilege is the union of all connected credentials. The Send Email node could treat an untrusted non-string body value as a file path or URL, enabling local-file disclosure when a public webhook fed that value into a configured mail workflow (GHSA-2x35-3fw4-9jr4). Snowflake’s Execute Query operation interpolated expression values into raw SQL (GHSA-652q-gvq3-74qv). The Postgres Trigger node failed to escape channel, function, and trigger identifiers, allowing an authenticated user to run arbitrary SQL with the connected database credential (GHSA-jqwr-vx3p-r266).

The advisories do not claim every path is remotely exploitable by an unauthenticated caller. Their prerequisites differ: workflow-edit rights, shared workflows, known credential IDs, enabled token exchange, exposed webhooks, configured nodes, or actor influence over tool input. Defenders should preserve those distinctions while recognizing that real agentic systems are specifically built to move untrusted data through highly privileged integrations.

Defensive priorities

  • Move to 2.32.1 or later. Verify the running worker, task-runner, and web process versions after rollout. Do not infer complete coverage from one advisory’s older-branch patch list.
  • Treat workflow authors as privileged until patched. Remove unnecessary create, edit, execute, and shared-workflow rights. The vendor repeatedly notes that restricting access is only a temporary mitigation, not a full fix.
  • Constrain the n8n OS identity. Run it as a dedicated non-root user with a read-only root filesystem where practical, narrow writable mounts, no host socket, and no ambient cloud credentials. File write, file read, Git hooks, and expression escape all inherit this account’s reach.
  • Enforce egress outside n8n. Block metadata, link-local, loopback, management, and unnecessary internal ranges at the network layer. Application SSRF and allowed-domain controls cannot be the only barrier.
  • Review shared secrets and workflows. Inventory restricted credentials, inline sub-workflows, expression-selected auth types, custom AI/LLM endpoints, embed-login trusted keys, and access to credential identifiers. Rotate secrets if logs or workflow history indicate unauthorized use.
  • Disable unneeded nodes during remediation. The advisories name Git, Edit Image, MCP Client, Postgres Trigger, Send Email, HTTP Request, computer-use, and module-enabled Code nodes among the affected surfaces. Use NODES_EXCLUDE and remove public triggers where the relevant feature is unnecessary.
  • Separate tenants at the process boundary. A shared module cache and process-wide prototype corruption show that project-level checks do not provide hard isolation. Use dedicated runners or instances for principals that should not share fate or memory.

This disclosure set is a compact map of the automation security problem. Policy existed, but execution-time resolution bypassed it; sandboxes existed, but trusted host components crossed them; tenant abstractions existed, but process globals and caches remained shared. Patching is urgent. The durable fix is to make the worker’s filesystem, network, credentials, and process identity no more powerful than the specific workflow being executed.

Sources: