CVE-2026-33665: 
NixOS vulnerability analysis and mitigation

CVE-2026-33665 is an improper authentication vulnerability in n8n, an open-source workflow automation platform, that allows authenticated LDAP users to perform privilege escalation and permanent account takeover. When LDAP authentication is enabled, n8n automatically links an LDAP identity to an existing local account if the LDAP email attribute matches the local account's email — without additional verification. This flaw affects n8n versions prior to 1.121.0 (v1 branch) and versions 2.0.0-rc.0 through 2.4.0 (v2 branch). It was disclosed on March 25, 2026, with patches released the same day. The vulnerability carries a CVSS v4.0 base score of 8.8 (High) and a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-287 (Improper Authentication): n8n's LDAP login flow trusts the email attribute returned by the LDAP directory to identify and link accounts, without verifying that the claimed email uniquely and securely belongs to the authenticating user. An attacker who has an authenticated LDAP account and the ability to modify their own LDAP email attribute can set it to match the email address of any existing local n8n account — including an administrator's. Upon the next login, n8n silently links the attacker's LDAP identity to the victim's local account, granting full access. Critically, the account linkage persists in n8n's database even after the LDAP email attribute is reverted, making the takeover permanent. Exploitation requires LDAP authentication to be configured and active (a non-default setting) and the attacker must have write access to their own LDAP email attribute (GitHub Advisory).

Successful exploitation allows an authenticated LDAP user to permanently take over any n8n account, including administrator accounts, resulting in full confidentiality and integrity compromise of the n8n instance. An attacker with administrative access could read all workflow configurations (which may contain API keys, credentials, and sensitive business logic), modify or delete workflows, and pivot to connected external systems via n8n's integrations. The persistence of the account linkage means the compromise survives credential resets and LDAP attribute reversions, making remediation without patching extremely difficult (GitHub Advisory, Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.013% (0.03% per GitHub Advisory), placing it in the 9th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires a low-privilege LDAP account and the ability to modify one's own LDAP email attribute, which may be restricted in hardened directory environments, contributing to the higher attack complexity rating in CVSS v3.1.

1. Reconnaissance: Identify an n8n instance with LDAP authentication enabled. Confirm the target is running a vulnerable version (< 1.121.0 or 2.0.0-rc.0 to < 2.4.0). Enumerate user email addresses associated with high-privilege accounts (e.g., administrator) through available means such as n8n's user interface, API, or social engineering.
2. Obtain LDAP credentials: Acquire or already possess valid credentials for an LDAP account on the directory server used by the n8n instance.
3. Modify LDAP email attribute: Using LDAP tools (e.g., ldapmodify, an LDAP admin GUI, or a self-service portal), change the attacker's own LDAP mail attribute to match the email address of the target n8n account (e.g., admin@example.com).
4. Trigger account linkage: Log in to the n8n instance using the attacker's LDAP credentials. n8n's authentication flow reads the LDAP email attribute, finds a matching local account, and automatically links the LDAP identity to the victim's local account.
5. Gain full account access: The attacker is now authenticated as the victim user (e.g., administrator) and has full access to their n8n account, including all workflows, credentials, and administrative functions.
6. Establish persistence: Optionally revert the LDAP email attribute to its original value. The account linkage in n8n's database persists, allowing the attacker to log in as the victim account at any future time using their own LDAP credentials (GitHub Advisory).

• Logs: n8n authentication logs showing a successful login for a high-privilege user (e.g., administrator) from an LDAP identity that does not match the expected LDAP distinguished name (DN) or username for that account.
• Logs: LDAP directory access logs showing modification of a user's mail attribute, particularly if the new value matches another user's registered email in n8n, followed shortly by an n8n login event.
• Database: Unexpected or newly created entries in n8n's user_identity or equivalent account-linking table associating an LDAP identity with a local account that previously had no LDAP linkage.
• Application Behavior: Administrator-level actions (workflow creation/deletion, credential management, user management) performed during sessions that originated from an unexpected LDAP user or at unusual times.
• Network: Login requests to the n8n instance from IP addresses not previously associated with the targeted administrator account, coinciding with LDAP authentication events (GitHub Advisory).

The vulnerability is fixed in n8n versions 2.4.0 (v2 branch) and 1.121.0 (v1 branch); upgrading to one of these versions or later is the recommended remediation (GitHub Advisory). If immediate upgrade is not possible, administrators should apply the following temporary mitigations in order of priority:

• Disable LDAP authentication entirely until the instance can be upgraded.
• Restrict LDAP directory permissions to prevent users from modifying their own mail (email) attributes.
• Audit existing LDAP-linked accounts for unexpected associations between LDAP identities and local n8n accounts.

Note that these workarounds do not fully remediate the risk, as any linkages already established will persist.

The advisory was published by the n8n security team (credited to reporters weblover12, 34selen, B0RI, and jh-hack) on March 25, 2026, with patches released simultaneously (GitHub Advisory). The vulnerability was detected by Qualys (detection ID 5009652) and indexed by multiple vulnerability tracking platforms shortly after disclosure. No significant public researcher commentary, social media discussion, or media coverage beyond standard vulnerability database indexing has been identified at this time.