The CISA has ordered federal agencies to patch a remote code execution vulnerability in the n8n workflow automation platform that could allow attackers to steal stored credentials such as API keys, OAuth tokens, and passwords, or pivot into connected systems that rely on the automation platform.
Security researchers found that multiple vulnerabilities in n8n could allow attackers to execute commands on vulnerable systems, escape sandbox protections, and potentially take full control of affected servers. One flaw involves an expression injection vulnerability that allows attackers to submit malicious input that is evaluated by the platform, while a second issue can be chained to bypass sandbox protections and execute commands directly on the host system.
Because n8n often stores credentials used to connect to external services and infrastructure, researchers warned that a compromised instance could expose multiple integrated systems and sensitive data across an organization’s environment.
n8n has more than 50,000 weekly npm downloads and over 100 million Docker pulls.
John Carberry, Solution Sleuth, Xcape, Inc.:
“Federal agencies are racing to patch n8n workflow automation servers following a CISA directive targeting an actively exploited expression injection vulnerability. Despite previous security updates, researchers discovered multiple bypasses (CVE-2026-25049 and CVE-2026-27577) that allow attackers to escape the platform’s sandbox and execute arbitrary code on the host system. This cycle of incomplete patching is particularly dangerous for automation tools that serve as a central repository for sensitive API keys and OAuth tokens across the Enterprise.
“For security professionals, this highlights the fragility of relying on software-defined sandboxes when the underlying application logic remains inherently permissive. Defenders must prioritize immediate updates to version 1.76.3 or later and audit all connected service credentials for signs of lateral movement. We need to stop treating sandbox escapes as isolated bugs and recognize them as fundamental design failures that require more than a quick syntax fix.
“Patching a sandbox escape with a regex filter is like trying to fix a leaky dam with a Post-it note.”
Denis Calderone, CTO, Suzu Labs:
“n8n is under sustained assault from multiple angles right now, and CISA just confirmed this latest one is being actively exploited. We’ve seen four critical RCE vulnerabilities in just the last three months, and an active supply chain attack to boot.
“At its core, n8n is a credential vault. It stores API keys, OAuth tokens, database passwords, cloud storage credentials for every service it connects to, and it connects to a lot of services. Compromise one n8n instance and you don’t just own the automation platform, you get the keys to every system it touches. Numerous vulnerabilities from VMware to Cisco to n8n have been bringing to light the inherited trust problem once again. The underlying issue here is that your management and orchestration tools carry the deepest trust in your environment, and attackers know it.
“What makes this one particularly concerning is the attack surface. Shadowserver is tracking over 40,000 unpatched instances still sitting on the open internet, and researchers identified more than 100,000 potentially vulnerable deployments globally. The patch has been available since December. That’s three months of exposure while these things are being actively exploited, and exploitation apparently spiked over the Christmas holiday when teams were thin.
“If you’re running n8n, patch immediately, audit what credentials are stored in it, and restrict who can create or edit workflows. Yes, n8n needs internet-facing endpoints for webhooks and forms, but that doesn’t mean the management interface and credential store should be exposed along with them. Separate your webhook endpoints from your admin panel, and put the editor behind a VPN or proper access controls.”
Vishal Agarwal, CTO, Averlon:
“Automation platforms like n8n often sit in the middle of many internal systems and services, storing the API keys, tokens, and credentials needed to connect them. When vulnerabilities appear in these platforms, the real risk isn’t just the initial compromise. It’s the blast radius: what those stored credentials allow an attacker to reach next, and how far that reach extends across connected systems.
“Even if the initial access comes from a regular user account, these vulnerabilities can expose much more powerful credentials stored within the platform. Organizations should not only patch quickly but also map the pathways those credentials create across their environment.”
I am glad that the CISA is around because it forces organizations to take cybersecurity seriously. Of course organizations have to take cybersecurity seriously. But that’s another story.
GhostPoster, and Why Browser Extensions Are Your Next Major Blind Spot
Posted in Commentary with tags Fortra on March 17, 2026 by itnerdBrowser extensions have quietly become one of the more dangerous and overlooked attack surfaces within the enterprise. Fortra Intelligence and Research Experts (FIRE) have released a new Browser Extension Threat Guide that breaks down why this risk is escalating and what security teams need to do now to close the gap.
This in‑depth guide covers:
If extensions aren’t already on your threat model, this guide will show you why they need to be. You can access it here: https://www.fortra.com/resources/guides/browser-extension-threat-guide
Leave a comment »