GHSA-2vx9-7wpg-88jq: n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
Summary
A vulnerability in n8n's `ExecuteWorkflow` node allowed authenticated users to read arbitrary files from the server by bypassing file access restrictions through the REST API (a web-based interface for controlling the software). An attacker could discover if files exist on the server or potentially load and execute workflow files, affecting connected systems.
Solution / Mitigation
Upgrade to n8n version 2.20.0 or 2.19.3 or later. If upgrading is not immediately possible, administrators can temporarily restrict workflow creation and editing permissions to trusted users only, and restrict network access to the n8n REST API to trusted users only. However, these workarounds do not fully remediate the risk and should only be used as short-term measures.
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-2vx9-7wpg-88jq
First tracked: May 19, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%