Cyber Posture

CVE-2026-33660

High

Published: 25 March 2026

Published
25 March 2026
Modified
30 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2026-33660 is a high-severity vulnerability (CVSS 8.8) affecting n8n, an open-source workflow automation platform, in versions prior to 2.14.1, 2.13.3, and 1.123.26. The flaw stems from insufficient sandboxing in the AlaSQL library used by the Merge node's "Combine by SQL" mode (CWE-94: Improper Control of Generation of Code, CWE-89: Improper Neutralization of Special Elements used in an SQL Command). This allows authenticated users with permissions to create or modify workflows to craft SQL statements that bypass restrictions, enabling arbitrary local file reads on the n8n host and potentially leading to remote code execution.

An attacker requires low-privilege network access as an authenticated user (PR:L) with workflow creation or modification rights, making exploitation straightforward with no user interaction needed (AC:L, UI:N). Successful attacks can result in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), such as exfiltrating sensitive server files or fully compromising the n8n instance through RCE, without scope changes (S:U).

The n8n security advisory recommends upgrading to versions 2.14.1, 2.13.3, or 1.123.26 or later for full remediation. As temporary measures, administrators should restrict workflow creation and editing to fully trusted users only and/or disable the Merge node by setting the `NODES_EXCLUDE` environment variable to include `n8n-nodes-base.merge`. These workarounds are not comprehensive and serve only as short-term protections. Details are available in the advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-58qr-rcgv-642v.

Details

CWE(s)
CWE-94CWE-89

Affected Products

n8n
n8n
2.14.0 · ≤ 1.123.27 · 2.0.0 — 2.13.3

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Vulnerability directly enables arbitrary local file reads (T1005: Data from Local System) and facilitates privilege escalation via potential RCE from low-privileged authenticated access (T1068: Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References