Cybersecurity articles tagged #N8n on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/n8n-rce-via-expression-sandbox-escape-mitigation-guidehttps://runtimerebel.com/blog/n8n-rce-via-expression-sandbox-escape-mitigation-guideAuthenticated workflow editors in n8n can execute arbitrary OS commands via a sandbox escape. Update to versions 2.31.5 or 2.32.1 to mitigate this risk.Mon, 27 Jul 2026 14:38:21 GMTN8nCVE-2026-27577Sandbox EscapeRCESecurity Joeshttps://runtimerebel.com/blog/n8n-token-exchange-flaw-impersonation-via-sub-claim-bypasshttps://runtimerebel.com/blog/n8n-token-exchange-flaw-impersonation-via-sub-claim-bypassA critical token exchange vulnerability in n8n Enterprise allows attackers to impersonate users by leveraging `sub` claim matching across multiple external issuers…Thu, 16 Jul 2026 17:23:19 GMTN8nToken ExchangeAuthentication BypassImpersonationJWTWorkflow Automationhttps://runtimerebel.com/blog/ivanti-fortinet-and-n8n-disclose-critical-rce-and-auth-bypass-flawshttps://runtimerebel.com/blog/ivanti-fortinet-and-n8n-disclose-critical-rce-and-auth-bypass-flawsIvanti, Fortinet, n8n, and SAP release urgent security patches for critical vulnerabilities including CVE-2026-5444 and CVE-2026-8043. Update systems now.Mon, 18 May 2026 13:23:34 GMTCVE-2026-8043CVE-2026-5444IvantiFortinetN8nRCEhttps://runtimerebel.com/blog/abused-n8n-webhooks-facilitate-automated-malware-delivery-since-2025https://runtimerebel.com/blog/abused-n8n-webhooks-facilitate-automated-malware-delivery-since-2025Threat actors are weaponizing n8n AI workflow automation webhooks to bypass email filters and distribute malware in persistent phishing campaigns.Wed, 15 Apr 2026 20:22:35 GMTN8nPhishingWebhooksMalware DeliveryAutomation Abusehttps://runtimerebel.com/blog/n8n-flaw-exploitation-slopoly-malware-apparmor-lpe-key-threatshttps://runtimerebel.com/blog/n8n-flaw-exploitation-slopoly-malware-apparmor-lpe-key-threatsAnalysis of recent cybersecurity threats: actively exploited N8n flaw, Slopoly malware, Linux AppArmor root privilege vulnerability, and Telus Digital breach.Fri, 13 Mar 2026 16:20:49 GMTN8nSlopolyMalwareAppArmorLinuxPrivilege EscalationData BreachTelus DigitalExploitationhttps://runtimerebel.com/blog/n8n-rce-via-cve-2025-68613-cisa-flags-active-exploitationhttps://runtimerebel.com/blog/n8n-rce-via-cve-2025-68613-cisa-flags-active-exploitationCISA adds CVE-2025-68613 to its KEV catalog after reports of active exploitation against n8n workflow automation instances. Patch now to prevent RCE.Thu, 12 Mar 2026 08:18:11 GMTCVE-2025-68613N8nRCECISA KEVExpression Injectionhttps://runtimerebel.com/blog/cve-2025-68613-n8n-improper-code-control-actively-exploitedhttps://runtimerebel.com/blog/cve-2025-68613-n8n-improper-code-control-actively-exploitedCISA adds CVE-2025-68613, an n8n vulnerability involving improper control of dynamically-managed code, to its KEV Catalog due to active exploitation.Wed, 11 Mar 2026 20:15:24 GMTCVE-2025-68613N8nKEV CatalogImproper Control of Dynamically Managed Code Resourceshttps://runtimerebel.com/blog/n8n-rce-vulnerabilities-cve-2026-27577-and-cve-2026-27493-patch-nowhttps://runtimerebel.com/blog/n8n-rce-vulnerabilities-cve-2026-27577-and-cve-2026-27493-patch-nowCritical vulnerabilities in the n8n workflow automation platform allow unauthenticated remote code execution and sandbox escapes. Update instances immediately.Wed, 11 Mar 2026 16:26:24 GMTN8nCVE-2026-27577CVE-2026-27493RCEWorkflow Automation