CVE-2026-33665: n8n LDAP Authentication Bypass Vulnerability

CVE-2026-33665 Overview

CVE-2026-33665 is an authentication bypass vulnerability in n8n, an open source workflow automation platform. The vulnerability exists in the LDAP authentication mechanism, where n8n automatically links an LDAP identity to an existing local account if the LDAP email attribute matches the local account's email address. An authenticated LDAP user who can control their own LDAP email attribute can set it to match another user's email—including an administrator's—and upon login, gain full access to that account. The account linkage persists even if the LDAP email is later reverted, resulting in a permanent account takeover.

Critical Impact

Authenticated LDAP users can escalate privileges to administrator level and maintain persistent access to compromised accounts even after reverting their LDAP email attribute changes.

Affected Products

• n8n versions prior to 2.4.0
• n8n versions prior to 1.121.0
• n8n installations with LDAP authentication enabled

Discovery Timeline

• 2026-03-25 - CVE-2026-33665 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33665

Vulnerability Analysis

This vulnerability stems from improper authentication handling (CWE-287) in n8n's LDAP integration. The core issue lies in the automatic account linking logic that trusts LDAP-provided email attributes without adequate verification or authorization checks. When LDAP authentication is enabled, the platform performs email-based matching to link LDAP identities with existing local accounts.

The attack requires LDAP authentication to be configured and active (which is non-default), and the attacker must have the ability to modify their own LDAP email attribute within the directory service. While these prerequisites limit the attack surface, the impact is severe when exploited—allowing complete administrative account takeover with persistent access.

Root Cause

The root cause is improper trust placed in user-controllable LDAP attributes during the account linking process. The n8n platform assumes that email addresses provided via LDAP are authoritative and can be used to automatically associate LDAP identities with pre-existing local accounts. This design flaw fails to consider that in many LDAP configurations, users may have the ability to modify their own email attributes, creating a path for privilege escalation.

Additionally, the account linkage mechanism lacks proper revocation logic—once an LDAP identity is linked to a local account, this association persists even if the LDAP email attribute is subsequently changed, making the takeover permanent.

Attack Vector

The attack is network-based and requires low privileges (an authenticated LDAP user account) but no user interaction. The attack proceeds as follows:

1. The attacker identifies the email address of a target user, preferably an administrator
2. The attacker modifies their own LDAP email attribute to match the target's email address
3. Upon the next LDAP authentication, n8n automatically links the attacker's LDAP identity to the target's local account
4. The attacker gains full access to the target account, including all administrative privileges
5. Even if the attacker reverts their LDAP email attribute to its original value, the account linkage remains, providing persistent unauthorized access

The vulnerability does not require the attacker to know the target's password—only their email address and the ability to modify LDAP attributes.

Detection Methods for CVE-2026-33665

Indicators of Compromise

• Unexpected LDAP account associations in the n8n user database
• Multiple LDAP identities linked to a single local account, particularly administrator accounts
• Audit logs showing LDAP email attribute changes followed by successful authentication to different local accounts
• Administrative account access from LDAP users who should not have such privileges

Detection Strategies

• Monitor LDAP directory logs for email attribute modifications, especially changes to values matching existing n8n account emails
• Implement alerting on new LDAP-to-local account linkages, particularly for privileged accounts
• Review n8n authentication logs for patterns where users authenticate via LDAP but access accounts not originally assigned to them
• Deploy behavioral analysis to detect users accessing resources or performing actions inconsistent with their normal role

Monitoring Recommendations

• Enable comprehensive audit logging for LDAP attribute changes in your directory service
• Configure alerts for any modifications to administrator account associations
• Establish baseline user behavior profiles to detect anomalous access patterns post-compromise
• Regularly audit LDAP-linked accounts to verify expected associations

How to Mitigate CVE-2026-33665

Immediate Actions Required

• Upgrade n8n to version 2.4.0 or 1.121.0 or later immediately
• Audit all existing LDAP-linked accounts for unexpected or unauthorized associations
• Review administrator account associations to ensure no unauthorized LDAP identities have been linked
• Consider resetting compromised accounts and revoking associated sessions if suspicious linkages are discovered

Patch Information

The vulnerability has been fixed in n8n versions 2.4.0 and 1.121.0. Users should upgrade to one of these versions or later to fully remediate the vulnerability. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Disable LDAP authentication entirely until the instance can be upgraded to a patched version
• Restrict LDAP directory permissions so that users cannot modify their own email attributes
• Implement additional access controls at the directory level to prevent unauthorized attribute changes
• Audit existing LDAP-linked accounts for unexpected account associations and remove suspicious linkages manually

If upgrading is not immediately possible, these workarounds provide temporary risk reduction but do not fully remediate the vulnerability. They should only be used as short-term mitigation measures while planning the upgrade to a patched version.