{"id":"CVE-2026-118648","kind":"vulnerability","aliases":["CVE-2026-118648"],"related":[],"title":"n8n: webhook error responses omit CSP, enabling stored cross-site scripting","description":"n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.","summary":"n8n webhook response paths such as error responses and responses without headers omit the sandbox Content-Security-Policy. An authenticated workflow creator can serve HTML that runs script on the n8n origin and act with the session of anyone who opens the webhook URL.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","n8n","self-hosted","webhooks"],"not_affected_if":["patched-version","single-user-instance"],"how_to_check":"- Run `n8n --version` (or check the container image tag) and compare against `1.123.85`, `2.43.5` and `2.44.1`\n- Check whether your n8n instance exposes webhook URLs to users who are logged into the n8n UI","fix":"- Upgrade n8n 1.x to `1.123.85` or later\n- Upgrade n8n 2.x to `2.43.5` or later, and 2.44.x to `2.44.1` or later","status":"open","published_at":"2026-10-28T19:17:33+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:35:46+00:00","updated_at":"2026-10-28T19:35:46+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-28T19:35:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade n8n 1.x to `1.123.85` or later\n- Upgrade n8n 2.x to `2.43.5` or later, and 2.44.x to `2.44.1` or later","reach":"internet","title":"n8n: webhook error responses omit CSP, enabling stored cross-site scripting","impact":"medium","summary":"n8n webhook response paths such as error responses and responses without headers omit the sandbox Content-Security-Policy. An authenticated workflow creator can serve HTML that runs script on the n8n origin and act with the session of anyone who opens the webhook URL.","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","webhooks"],"confidence":0.7,"needs_auth":"yes","worst_case":"Scripts run on the n8n origin and act with victims' sessions","analyst_note":"","how_to_check":"- Run `n8n --version` (or check the container image tag) and compare against `1.123.85`, `2.43.5` and `2.44.1`\n- Check whether your n8n instance exposes webhook URLs to users who are logged into the n8n UI","needs_analyst":false,"not_affected_if":["patched-version","single-user-instance"],"who_is_affected":"Self-hosted or cloud n8n instances on the affected version ranges where members can create and activate workflows with webhook triggers. Exposure depends on whether logged-in users open webhook URLs in a browser; instances on patched versions or with only trusted, single-user access have less exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000617,"input_tokens":3375,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118648':15A,18A '-2026':14A,17A '1.123.85':74C '2':75C '2.43.5':78C '2.44':80C '2.44.1':83C 'act':61B,131C 'activ':118C 'ai':20B 'ai-tool':19B 'anyon':66B 'authent':47B,112C 'contain':84C 'content':43B,109C 'content-security-polici':42B,108C 'creat':116C 'creator':49B 'cross':10A,88C 'cross-sit':9A,87C 'csp':6A 'cve':13A,16A 'enabl':7A 'error':3A,33B,99C 'header':38B,104C 'host':25B 'html':52B,122C 'let':129C 'member':113C 'n8n':1A,22B,27B,58B,72C,127C 'omit':5A,39B,105C 'open':68B,138C 'origin':59B,128C 'path':30B,96C 'polici':45B,111C 'respons':4A,29B,34B,36B,95C,100C,102C 'run':54B,124C 'sandbox':41B,107C 'script':12A,55B,90C,130C 'secur':44B,110C 'self':24B 'self-host':23B 'serv':51B,121C 'session':64B,134C 'site':11A,89C 'store':8A,86C 'tool':21B 'url':71B,141C 'user':136C 'vulner':91C 'webhook':2A,26B,28B,70B,94C,140C 'without':37B,103C 'workflow':48B,119C 'x':76C,81C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud n8n instances on the affected version ranges where members can create and activate workflows with webhook triggers. Exposure depends on whether logged-in users open webhook URLs in a browser; instances on patched versions or with only trusted, single-user access have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118648","severity":null,"published_at":"2026-10-28T19:17:33+00:00","modified_at":"2026-10-28T19:17:33+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}