FIND-20260324-007 · 2026-03-24 · Innovation Veille
n8n CVE-2025-68613 (CVSS 9.9) and CVE-2026-21858 (CVSS 10.0) — Critical RCE vulnerabilities
cve
MEDIUM
Two critical vulnerabilities in n8n workflow automation: CVE-2026-21858 (CVSS 10.0) allows unauthenticated attackers full control via expression injection (affects all versions < 1.65.0, fixed in 1.121.0). CVE-2025-68613 (CVSS 9.9) is an expression injection RCE requiring authentication (affects 0.211.0 to 1.120.x, fixed in 1.121.1). A related CVE-2025-68668 (CVSS 9.9) is a Python Code Node sandbox bypass. While ODS does not currently deploy n8n, the trending n8n-mcp tool (czlonkowski/n8n-mcp, 16k stars) integrates Claude Code with n8n — any ODS adoption of n8n must use version 1.121.1 or later.
Source
https://thehackernews.com/2026/01/critical-n8n-vulnerability-cvss-100.html
ODS Impact
ODS does not currently run n8n. If n8n is considered for the workflow engine or automation layer, ensure deployment is on version >= 1.121.1. The n8n-mcp tool trending today builds n8n workflows via Claude Code — if evaluated, pin to a patched n8n version. The Redpanda + Workflow Engine combination in the ODS spec may serve similar use cases without this attack surface.
Security Review
License: N/A | Maintenance: ACTIVE | Risk: MEDIUM | Recommendation: USE_WITH_CAUTION
Tags
n8n
cve
rce
critical
expression-injection
workflow
security