Is Your Automation Platform Secure? What the n8n Vulnerability Means for Business Users
In February 2026, security researchers disclosed CVE-2026-25049, a critical vulnerability in n8n, one of the most popular open-source automation platforms. The flaw scored 9.4 out of 10 on the severity scale. It let attackers execute system-level commands on any unpatched n8n server through a simple webhook call. No authentication required.
Over 103,000 n8n instances were exposed to this and related vulnerabilities, according to Censys scans. GreyNoise logged 33,000+ probe requests targeting n8n endpoints in a single week. And this wasn't even n8n's first critical flaw that month.
If you're running business automations on any platform, n8n, Zapier, Make, or something custom, this is worth paying attention to. Not because of one CVE, but because of what it reveals about how most businesses treat automation security.
What Actually Happened with n8n
The timeline is worth understanding because it shows a pattern, not a one-off.
December 2025: n8n patched CVE-2025-68613 (CVSS 9.9), an expression injection flaw that let authenticated users run arbitrary code. Over 103,000 instances were found vulnerable by Censys.
January 2026: Cyera disclosed CVE-2026-21858, nicknamed "Ni8mare." This one scored a perfect CVSS 10.0. An unauthenticated attacker could read arbitrary files, extract admin credentials, forge session cookies, and take complete control of the server. Shadowserver found 105,000+ vulnerable instances. Censys tracked 26,512 still exposed after disclosure.
February 2026: CVE-2026-25049 dropped. It bypassed the December patch entirely. Researcher Fatih Celik explained that the two vulnerabilities are essentially the same flaw: the second is just a bypass of the first fix. n8n's expression sandbox assumed that property access keys would always be strings (enforced in TypeScript annotations but never checked at runtime). Attackers used JavaScript destructuring to sidestep the check and execute system commands.
On top of that, n8n disclosed 11 additional security flaws the same month, including five rated critical. One of them (CVE-2026-21893) let authenticated admins run arbitrary system commands.
Why This Matters Beyond n8n
You might not use n8n. You might be on Zapier or Make and thinking this doesn't apply to you.
It does. Here's why.
Automation platforms are credential hubs. Every workflow you build connects to external services, your CRM, email provider, payment processor, cloud storage, AI APIs. Each connection requires stored credentials. As Michael Bell from Suzu Labs put it: "A compromised n8n instance gives an attacker the keys to your CRM platform, databases, cloud storage, communication tools, and whatever else you've integrated."
JFrog's security team made the same point: "As n8n spans an entire organization to automate AI workflows, it holds the keys to core tools, functions, and data from infrastructure, including LLM APIs, sales data, and internal IAM systems."
That applies to every automation platform, not just n8n. The credentials your Zapier account stores for Salesforce, Stripe, Gmail, and Slack are just as valuable to an attacker. The difference is who manages the security of the platform itself.
If your automations connect to financial tools or customer data, securing those credentials is non-negotiable. ComplianceAI monitors policy compliance and flags security gaps for $249, giving you audit trails without a dedicated compliance officer.
The Three Security Models (And Their Tradeoffs)
Not all automation platforms carry the same risks. The security model depends on who hosts the infrastructure.
Self-Hosted (n8n Community Edition)
You run n8n on your own server. Your data stays on your infrastructure. That sounds good for privacy, but it means you're responsible for patching, network configuration, access controls, and monitoring.
The 103,000 exposed instances Censys found? Those were self-hosted n8n servers sitting on the open internet. Many were running in Docker with default configurations. When CVE-2026-21858 hit, GreyNoise detected a coordinated scanning campaign using a custom n8n-scanner/1.0 tool, spinning up containers across 375+ IPs and probing vulnerable endpoints. They targeted the /proc filesystem for credential harvesting.
Self-hosting gives maximum control. But if you don't have a dedicated IT team patching regularly, you're running an internet-exposed credential vault with nobody watching.
Cloud-Managed (Zapier, Make, n8n Cloud)
The vendor handles infrastructure security, patching, and uptime. You don't worry about server configuration. This is the model most small businesses use.
The tradeoff: your data flows through their servers. Zapier processes all workflow data, including payloads, logs, and execution history, on their infrastructure. You can't inspect what happens at the infrastructure level. You're trusting their security team.
Make, based in Europe, stores data in the EU, which helps with GDPR. Zapier stores data on US servers. Neither gives you the option to self-host.
Managed n8n (n8n Cloud)
A middle ground. n8n hosts and patches the server; you configure the workflows. You get the flexibility of n8n without the server maintenance burden. But you're still subject to the same code-level vulnerabilities, they're just patched faster than most self-hosted users would do it themselves.
What Most Small Businesses Get Wrong
We've audited automation setups for dozens of clients. The same mistakes show up repeatedly.
Using a single "god" API key for everything. Most businesses create one API key per service and use it across every workflow. If any one workflow is compromised, every integration is exposed. The fix: create separate API keys per workflow, each scoped to the minimum permissions needed.
Never rotating credentials. API keys created two years ago are still active with full permissions. Nobody has audited which keys are in use, which are stale, and what they can access. Pillar Security's recommendation after the n8n disclosures: rotate all credentials immediately if running any affected version.
Leaving automation platforms on default settings. Default n8n installations expose the web interface publicly. Default Zapier accounts don't enforce multi-factor authentication on team members. Default Make accounts allow any team member to create and modify workflows. The defaults assume trust. Attackers don't.
No monitoring on automation activity. Workflows run silently in the background. If an attacker modifies a workflow to exfiltrate data, the dashboard still shows green. Nobody checks execution logs for unexpected behavior. The n8n attacks were particularly dangerous because, as security researchers noted, workflows continue running normally while data is being siphoned.
Credential management gets messy fast when you're juggling multiple connected services. ContractCraft automates document workflows with built-in access controls for $199, so you're not manually tracking who has access to what.
A Practical Security Checklist for Business Automations
Whether you're on Zapier, Make, n8n, or something else, these steps apply.
1. Update Your Platform
If you're self-hosting n8n, update to version 2.5.2 or later immediately. This patches CVE-2026-25049, CVE-2026-21858, and the other 11 disclosed flaws.
If you're on Zapier or Make, you're patched automatically. But check that your account settings are current, especially around authentication and team access.
2. Audit Your Stored Credentials
Log into your automation platform and review every stored connection. For each one, ask:
- Is this credential still needed?
- Does it have minimum required permissions?
- When was it last rotated?
- Who else has access to it?
Delete anything unused. Rotate anything older than 90 days.
3. Scope API Keys Properly
Stop using admin-level API keys in automations. Most services let you create keys with restricted scopes. A workflow that reads CRM contacts doesn't need write access to billing records.
Example: If a workflow pulls leads from HubSpot into a spreadsheet, it needs contacts.read only. Not contacts.write, not deals.read, not account.admin.
4. Enable MFA on Everything
Multi-factor authentication on your automation platform account. On every connected service. On the email account tied to password resets. This is the single cheapest security improvement you can make.
5. Restrict Workflow Editing
Not everyone on the team needs the ability to create or modify workflows. Limit editing permissions to specific team members. Review workflows before they go live. One of n8n's temporary mitigations for CVE-2026-25049 was restricting workflow creation to fully trusted users. That should be the default, not the emergency response.
6. Monitor Execution Logs
Check your automation logs weekly. Look for unexpected execution times, unfamiliar webhook triggers, or workflows that suddenly start failing. Most platforms have execution history. Almost nobody looks at it until something breaks.
How This Changes the Platform Choice Conversation
The n8n disclosures shift the calculus for businesses choosing between automation platforms.
n8n's value proposition has always been flexibility and self-hosting. That still holds. But the security track record in early 2026 (a CVSS 10.0 flaw, a bypass of its own patch, 11 additional CVEs in a single month) raises legitimate questions about code quality and security practices. If you're self-hosting n8n without dedicated security staff, the risk profile just changed.
Zapier and Make shift the security burden to their teams. You're trading control for convenience. For most small businesses without IT staff, that's the right tradeoff.
The real lesson isn't about one platform. It's that automation infrastructure is now critical business infrastructure. And most businesses treat it like a side project. The same company that would never leave their database exposed to the internet will run an n8n instance on a public IP with default credentials. The same team that mandates strong passwords for email will use a single unscoped API key across 30 automations.
What to Do This Week
- Check your n8n version (if applicable). If it's below 2.5.2, update today. Not next sprint. Today.
- List every credential stored in your automation platform. Export the list if possible.
- Delete unused connections. That Slack integration you tested six months ago and forgot about? It's still holding a valid OAuth token.
- Create a recurring calendar reminder to review automation credentials monthly. 30 minutes. Put it on the calendar.
- Turn on MFA for your automation platform account if it's not already enabled.
The n8n vulnerability wasn't exotic. It was a type confusion bug that bypassed a previous fix. The scanning campaigns were automated and widespread. The exposed instances numbered in the six figures. None of this required sophisticated nation-state capability. It was basic security hygiene that most self-hosted users hadn't applied.
Your automations hold the keys to your business tools. Treat them accordingly.
Automiva builds AI tools for businesses that take security seriously. If you're rethinking how your automations handle credentials and compliance, we can help.