n8n security woes roll on as new critical flaws bypass December fix

Multiple critical vulnerabilities (CVE-2026-25049) in the n8n automation platform allow authenticated users to inject crafted expressions into workflows that can execute system-level commands, potentially resulting in full server takeover and exposure of stored credentials (including API keys for OpenAI, Anthropic, AWS). Proof-of-concept shows low-effort exploitation via unauthenticated webhooks and JavaScript destructuring; patches have been released and organizations are urged to update, review permissions/workflows, and rotate sensitive credentials, with elevated risk for n8n Cloud multi-tenant environments.