n8n: Stored cross-site scripting via webhook responses
Summary
n8n before 1.123.85, 2.x before 2.43.5 and 2.44.x before 2.44.1 omit the sandbox Content-Security-Policy on some webhook response paths, such as error responses and responses without headers. An authenticated user who can create and activate workflows can serve HTML that runs on the n8n origin. When another user opens the webhook URL, the script can act with that user's session, for example to hijack the session or take over the account.
Affected
- n8n 1.x before 1.123.85
- n8n 2.x (stable) 2.0.0 to before 2.43.5
- n8n 2.44.x (beta) 2.44.0 to before 2.44.1
Fixed in
- n8n 1.123.85
- n8n 2.43.5
- n8n 2.44.1
- Later versions also contain the fix.
Workaround
Unknown. The vendor's workaround section could not be verified for this advisory.
Exploitation
- No known exploitation at the time of research.
- No public exploit code confirmed.
- Not listed in the CISA KEV catalog at the time of research.
Our recommendation
- Update self-hosted n8n to 1.123.85, 2.43.5, 2.44.1 or a later version.
- Until patched, restrict workflow create and activate rights to trusted staff.
- Avoid opening webhook URLs from untrusted workflows.
- Check exposure of self-hosted instances reachable from the internet and review who holds editor or member roles.
- Monitor for unexpected HTML or script content in webhook responses.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mp7q-23hg-35cf github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 428183 vuldb.com
- Vulners CVE record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:53.
Original description (NVD)
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.