CVE-2026-25056: 
NixOS vulnerability analysis and mitigation

CVE-2026-25056 is an arbitrary file write vulnerability in the n8n open-source workflow automation platform that can lead to remote code execution (RCE). The flaw exists in the Merge node's SQL Query mode and affects all n8n versions prior to 1.118.0 (on the 1.x branch) and versions 2.0.0 through 2.3.x (on the 2.x branch). It was disclosed on February 4, 2026, by researcher nlgbao1340 via GitHub's security advisory process. The vulnerability carries a CVSS v4.0 score of 9.4 (Critical) and a CVSS v3.1 score of 8.8 (High) (GitHub Advisory, n8n Security Advisory).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-693 (Protection Mechanism Failure), meaning the Merge node's SQL Query mode fails to properly validate or restrict the types and destinations of files it can write to the server filesystem. An authenticated attacker with permissions to create or modify workflows can craft a malicious workflow using the Merge node in SQL Query mode to write arbitrary files — including executable scripts or web shells — to any location accessible by the n8n process on the server. The attack is network-based, requires only low privileges (a standard authenticated account with workflow edit rights), and no user interaction beyond the attacker's own actions (GitHub Advisory, n8n Security Advisory).

Successful exploitation allows an authenticated attacker to write arbitrary files to the n8n server's filesystem, which can be leveraged to achieve full remote code execution. This results in complete compromise of confidentiality, integrity, and availability of the affected system — including access to sensitive workflow data, credentials stored in n8n, and any data processed through automation workflows. Given n8n's role as a workflow orchestration platform often integrated with numerous third-party services and APIs, a compromised instance could serve as a pivot point for lateral movement into connected systems (GitHub Advisory, n8n Security Advisory).

As of the time of disclosure, there is no confirmed public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). However, Field Effect reported that a PoC became available for related critical n8n RCE flaws disclosed around the same period, increasing the overall risk posture for n8n deployments (Field Effect). The EPSS score is approximately 0.144–0.225%, placing it in the 45th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Qualys (ID: 5007415) and Nessus (ID: 298990).

1. Reconnaissance: Identify internet-facing n8n instances running versions prior to 1.118.0 or between 2.0.0 and 2.3.x using tools like Shodan or Censys, searching for n8n's default web interface (typically port 5678).
2. Obtain credentials: Authenticate to the n8n instance using a valid account that has permissions to create or modify workflows. This could be a compromised user account, a self-registered account on a misconfigured instance, or credentials obtained through phishing.
3. Create malicious workflow: Log into the n8n web UI and create a new workflow. Add a Merge node and configure it to use SQL Query mode.
4. Craft file write payload: Within the Merge node's SQL Query mode, craft a query or configuration that instructs n8n to write attacker-controlled content (e.g., a Node.js script or shell script) to a target path on the server filesystem, such as the n8n working directory or a cron-accessible location.
5. Trigger workflow execution: Execute the workflow to cause n8n to write the malicious file to the specified server path.
6. Achieve RCE: Depending on the file written and its location, trigger execution — for example, by writing a script to a cron directory, overwriting an existing executable, or placing a file that n8n itself will load and execute on next startup or workflow run (GitHub Advisory, ctrlaltnod).

• Logs: n8n application logs showing Merge node executions in SQL Query mode by unexpected or low-privilege users; unusual workflow creation or modification events in audit logs, especially outside business hours.
• File System: Unexpected new files written to the n8n installation directory, working directory, or system directories (e.g., /etc/cron.d/, /tmp/, n8n's data path); scripts or executables with recent modification timestamps not associated with legitimate deployments.
• Process: Unusual child processes spawned by the n8n Node.js process (e.g., bash, sh, curl, wget, python, nc); reverse shell connections originating from the n8n process.
• Network: Outbound connections from the n8n server to unexpected external IP addresses or domains, particularly on non-standard ports; DNS lookups for attacker-controlled infrastructure from the n8n host.

Upgrade n8n to version 1.118.0 or later (for 1.x branch deployments) or version 2.4.0 or later (for 2.x branch deployments) to fully remediate the vulnerability. If immediate upgrading is not possible, administrators should restrict workflow creation and editing permissions to fully trusted users only, disable or block the Merge node globally using n8n's node-blocking configuration, and review existing workflows for suspicious use of the Merge node's SQL Query mode. These workarounds do not fully eliminate the risk and should be treated as temporary measures only (GitHub Advisory, n8n Security Advisory).

The vulnerability was part of a broader wave of critical n8n security disclosures, with security outlets describing the situation as a "triple threat" of RCE flaws affecting the platform (SecurityOnline, Purple Ops). Belgium's Centre for Cybersecurity (CCB) issued a warning about multiple critical vulnerabilities in n8n (CCB Belgium). Field Effect noted that PoC code became available for related n8n RCE flaws, elevating community concern (Field Effect). The Shadowserver Foundation also flagged activity related to n8n vulnerabilities on social media, indicating growing defender awareness (Shadowserver).