CVE-2026-25052: 
NixOS vulnerability analysis and mitigation

CVE-2026-25052 is a critical improper file access control vulnerability in n8n, an open-source workflow automation platform, that allows authenticated users with workflow creation or modification permissions to read arbitrary sensitive files from the n8n host system. Affected versions include all n8n releases prior to 1.123.18 (1.x branch) and versions 2.0.0 through 2.5.0 (2.x branch). The vulnerability was disclosed on February 4, 2026, and credited to researcher theolelasseux. It carries a CVSS v3.1 score of 9.9 (Critical) and a CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, n8n Security Advisory).

The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use / TOCTOU Race Condition), where n8n checks the state of a file resource before using it, but the resource's state can change between the check and the use in a way that invalidates the security check. This flaw specifically affects file access controls within the workflow engine, allowing exploitation via nodes that interact with the file system — notably the "Read/Write Files from Disk" and "Git" nodes. An attacker with low-privilege authenticated access (i.e., permission to create or modify workflows) can craft a workflow that exploits the race condition window to bypass path or access restrictions and read files outside the intended scope on the host system. No special configuration is required beyond having workflow editing permissions (GitHub Advisory, n8n Security Advisory).

Successful exploitation allows an authenticated low-privilege user to read sensitive files from the n8n host system, including critical configuration data and user credential stores. This can lead to complete account takeover of any user on the n8n instance, including administrators. The CVSS v4.0 scoring reflects high impact across confidentiality, integrity, and availability for both the vulnerable system and subsequent systems, with a changed scope indicating potential for lateral movement beyond the n8n application itself (GitHub Advisory, n8n Security Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.022% (6th percentile), indicating a currently low probability of exploitation within the next 30 days. No threat actor attribution has been reported. The vulnerability has been detected by Qualys (detection ID 5007422) and Nessus (detection ID 298985) scanners.

1. Reconnaissance: Identify an n8n instance running a vulnerable version (prior to 1.123.18 or 2.0.0–2.4.x) accessible over the network. Confirm the version via the n8n UI or API endpoint.
2. Obtain low-privilege access: Authenticate to the n8n instance using any account that has permission to create or modify workflows (e.g., a standard user account or a free trial account).
3. Craft a malicious workflow: Create or modify a workflow that uses file-system-interacting nodes such as "Read/Write Files from Disk" or "Git" nodes, specifying a target sensitive file path (e.g., /etc/passwd, n8n's .env configuration file, or the n8n database file containing hashed credentials).
4. Exploit the TOCTOU race condition: Trigger the workflow execution in a manner that exploits the window between the file access check and the actual file read, bypassing path restrictions to access files outside the intended scope.
5. Exfiltrate sensitive data: Retrieve the output of the workflow execution, which contains the contents of the targeted sensitive file — including configuration secrets, API keys, or user credential hashes.
6. Achieve account takeover: Use the extracted credentials or session tokens to escalate access and take over administrator or other user accounts on the n8n instance (GitHub Advisory, n8n Security Advisory).

• Logs: n8n workflow execution logs showing "Read/Write Files from Disk" or "Git" node executions accessing paths outside expected working directories (e.g., /etc/, /root/, application config directories); repeated workflow executions by low-privilege users targeting file read operations.
• File System: Unexpected access timestamps on sensitive files such as .env, database.sqlite, or system files like /etc/passwd or /etc/shadow correlating with n8n process activity.
• Network: Outbound data transfers from the n8n host to external IPs shortly after workflow execution events, potentially indicating credential or config exfiltration.
• Process: The n8n Node.js process (node) accessing file paths outside the n8n installation or data directory, observable via system audit logs (e.g., auditd on Linux with file access rules configured).

Upgrade n8n to version 1.123.18 (for the 1.x branch) or 2.5.0 (for the 2.x branch) immediately, as these versions contain the fix (GitHub Advisory). If immediate upgrade is not possible, apply the following temporary mitigations: (1) restrict workflow creation and editing permissions to fully trusted users only, and (2) globally disable or block the "Read/Write Files from Disk" and "Git" nodes using n8n's node-blocking configuration. Note that these workarounds do not fully remediate the risk and should only be used as short-term measures until patching is complete (n8n Security Advisory).

The vulnerability was part of a broader batch of security issues disclosed for n8n in early February 2026, covered by CSO Online and The Hacker News, which reported on multiple critical flaws in the platform (CSO Online, The Hacker News). Belgium's Centre for Cybersecurity (CCB) issued a warning about multiple critical vulnerabilities in n8n, and the German Federal Office for Information Security (BSI) also issued a security advisory that was discussed in the n8n community forum (CCB Advisory, n8n Community). The vulnerability was also highlighted by BeyondMachines in the context of n8n's broader security issues (BeyondMachines).