CVE-2026-33660: 
NixOS vulnerability analysis and mitigation

CVE-2026-33660 is a critical remote code execution (RCE) vulnerability in n8n, an open-source workflow automation platform, affecting the Merge node's "Combine by SQL" mode powered by AlaSQL. An authenticated user with workflow creation or editing permissions can exploit insufficient sandbox restrictions to read local files on the n8n host and execute arbitrary code. The vulnerability affects n8n versions prior to 1.123.27, versions 2.0.0-rc.0 through 2.13.2, and version 2.14.0 specifically. It was disclosed on March 25, 2026, with patches released the same day. The CVSS v4.0 base score is 9.4 (Critical) and the CVSS v3.1 base score is 8.8 (High) (GitHub Advisory, n8n Security Advisory).

The root cause is an insufficiently restricted AlaSQL sandbox within the Merge node's "Combine by SQL" mode, classified as CWE-94 (Code Injection) and CWE-89 (SQL Injection). AlaSQL, a JavaScript-based SQL engine, supports extended SQL syntax that can interact with the underlying filesystem and execute JavaScript code; the sandbox failed to block these dangerous SQL statements, allowing user-supplied SQL queries to escape the intended data-processing context. An attacker with low-privileged authenticated access (workflow create/edit permissions) can craft a malicious workflow containing a Merge node with SQL payloads that read arbitrary local files (e.g., /etc/passwd, credential files) or execute system commands, all over the network with no user interaction required (GitHub Advisory, n8n Security Advisory).

Successful exploitation allows an authenticated attacker to read sensitive local files on the n8n server (e.g., configuration files, credentials, private keys) and achieve full remote code execution on the host system. This can lead to complete compromise of the n8n instance, unauthorized access to integrated third-party services and credentials stored within workflows, data exfiltration, and potential lateral movement to other systems reachable from the n8n host. Both the vulnerable system and subsequent systems are rated with high confidentiality, integrity, and availability impact under CVSS v4.0 (GitHub Advisory, n8n Security Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.08–0.11% (24th percentile), indicating a currently low but non-negligible probability of exploitation within 30 days. The attack requires only low-level authenticated access with no user interaction, making it relatively straightforward to exploit if credentials are obtained (GitHub Advisory). No specific threat actor attribution has been reported.

1. Reconnaissance: Identify n8n instances running vulnerable versions (< 1.123.27, 2.0.0-rc.0 to < 2.13.3, or == 2.14.0) using internet scanning tools such as Shodan or Censys, or by reviewing internal asset inventories.
2. Obtain Authenticated Access: Log in to the n8n instance using valid credentials — these may be obtained via phishing, credential stuffing, or by registering a low-privileged account if self-registration is enabled.
3. Create or Modify a Workflow: Navigate to the n8n workflow editor and create a new workflow (or modify an existing one) that includes a Merge node.
4. Configure the Merge Node: Set the Merge node's operation mode to "Combine by SQL" (AlaSQL mode), which accepts user-supplied SQL queries for data merging.
5. Inject Malicious SQL Payload: Enter a crafted AlaSQL statement that abuses AlaSQL's extended capabilities — for example, using AlaSQL's REQUIRE or filesystem-access functions to read local files (e.g., SELECT * FROM TXT('/etc/passwd')) or execute JavaScript code that spawns system commands.
6. Execute the Workflow: Trigger the workflow execution. The AlaSQL sandbox processes the malicious SQL, bypassing restrictions and reading local files or executing arbitrary code on the n8n host.
7. Achieve Objective: Exfiltrate sensitive file contents via workflow output, establish a reverse shell, or pivot to other systems accessible from the n8n host (GitHub Advisory, n8n Security Advisory).

• Logs: n8n application logs showing workflow executions involving the Merge node with unusual or complex SQL queries; error messages from AlaSQL referencing filesystem paths or unexpected JavaScript execution.
• File System: Unexpected access to sensitive files (e.g., /etc/passwd, .env, credential files) by the n8n process; new files or scripts written to the n8n working directory or temp directories.
• Network: Outbound connections from the n8n host to unknown external IP addresses or domains, particularly following workflow execution events; unusual DNS lookups originating from the n8n process.
• Process: Unexpected child processes spawned by the n8n Node.js process (e.g., sh, bash, curl, wget, python); unusual system calls or process activity tied to the n8n service account.
• Application: New or modified workflows containing Merge nodes with "Combine by SQL" mode configured with non-standard or obfuscated SQL queries; workflow creation events by accounts not typically associated with workflow development.

Users should upgrade n8n to the patched versions: 1.123.27 (for the 1.x branch), 2.13.3 (for the 2.13.x branch), or 2.14.1 (for the 2.14.x branch) (GitHub Advisory, n8n Security Advisory). If immediate upgrading is not possible, two temporary mitigations are available: (1) restrict workflow creation and editing permissions to fully trusted users only, and (2) disable the Merge node entirely by adding n8n-nodes-base.merge to the NODES_EXCLUDE environment variable. These workarounds do not fully eliminate the risk and should only be used as short-term measures while patching is underway.

The Belgian Centre for Cybersecurity (CCB) issued an advisory urging organizations to patch immediately, characterizing the vulnerabilities as critical (CCB Advisory). Heise Online covered the disclosure, describing it as "two critical malicious code vulnerabilities" threatening the n8n automation platform (Heise). Qualys published a threat protection blog post highlighting the RCE risk and the need for prompt patching. The vulnerability was also featured in The Hacker News weekly recap and Greenbone's March 2026 threat report as a notable critical risk. Community discussion on Bluesky and security news aggregators noted the low exploitation barrier given the only requirement of authenticated access with workflow permissions.