Critical Remote Code Execution Vulnerability in n8n Exposes Browser Sessions to Unauthenticated Attackers
Overview
CVE-2026-54309, a critical unauthenticated remote code execution flaw in n8n, enables attackers to hijack browser sessions, execute arbitrary JavaScript, and steal sensitive data. With a CVSS score of 10.0, this vulnerability affects widely adopted workflow automation platforms when configured in HTTP transport mode.
Technical Analysis
The vulnerability stems from the @n8n/mcp-browser module's HTTP transport endpoint, which lacks authentication for session initialization and tool invocation. Attackers can exploit this by sending crafted HTTP requests to establish sessions and invoke browser-control tools. This allows navigation, cookie theft, and arbitrary code execution in connected browsers, particularly when the AI Browser Bridge extension is active. Exploitation requires network reachability of the MCP endpoint.
Enterprise & DIB Impact
Defense Industrial Base (DIB) and enterprise environments leveraging n8n for automation face severe risks, including unauthenticated access to internal systems, credential theft, and browser-based supply chain attacks. Malicious websites or compromised internal services could exploit this flaw to pivot into sensitive networks.
Recommended Actions
- Upgrade to n8n 2.25.7 or 2.26.2 immediately
- disable HTTP transport mode (--transport http) if not required
- restrict network access to MCP endpoints via firewalls
- implement monitoring for anomalous session activity in logs
- and review custom integrations for exposed HTTP endpoints.
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →