n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover
High8.2CVE-2026-33665 · Published Mar 25, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | >= 2.0.0-rc.0, < 2.4.0 | 2.4.0 |
| < 1.121.0 | 1.121.0 |
Details and references
## Impact When LDAP authentication is enabled, n8n automatically linked an LDAP identity to an existing local account if the LDAP email attribute matched the local account's email. An authenticated LDAP user who could control their own LDAP email attribute could set it to match another user's email , including an administrator's , and upon login gain full access to that account. The account linkage persisted even if the LDAP email was later reverted, resulting in a permanent account takeover. - LDAP authentication must be configured and active (non-default). ## Patches The issue has been fixed in n8n versions 2.4.0 and 1.121.0. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Disable LDAP authentication until the instance can be upgraded. - Restrict LDAP directory permissions so that users cannot modify their own email attributes. - Audit existing LDAP-linked accounts for unexpected account associations. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2026-33665
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 25 | n8n has In-Process Memory Disclosure in its Task Runner CVE-2026-27496High6.5fixed in 1.123.22, 2.9.3, 2.10.1 | High6.5 | 1.123.22, 2.9.3, 2.10.1 |
| Mar 25 | n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CVE-2026-33660Critical9.9fixed in 1.123.27, 2.13.3, 2.14.1 | Critical9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 25 | n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition CVE-2026-33663High9.9fixed in 1.123.27, 2.13.3, 2.14.1 | High9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 25 | n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK CVE-2026-33720Medium4.7fixed in 2.8.0 | Medium4.7 | 2.8.0 |
| Mar 25 | n8n Has External Secrets Authorization Bypass in Credential Saving CVE-2026-33722High6.3fixed in 1.123.23, 2.6.4 | High6.3 | 1.123.23, 2.6.4 |
| Mar 25 | n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no CVE-2026-33724Medium5.4fixed in 2.5.0 | Medium5.4 | 2.5.0 |