CVE-2026-54301

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2

Description An authenticated user with workflow edit access can configure a 'Respond to Webhook' node to serve binary content using an attacker-controlled Content-Type. This binary response path bypasses the central Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting) sandbox header. Consequently, a public webhook can execute JavaScript within the n8n origin when accessed by an authenticated user, granting access to that user's session.

Recommendations Update to version 1.123.55. Update to version 2.25.7. Update to version 2.26.2. Limit workflow creation and editing permissions to fully trusted users only. Disable the 'Respond to Webhook' node by adding n8n-nodes-base.respondToWebhook to the NODES EXCLUDE environment variable.