n8n Queue Mode Community Package Installation Validation Bypass Vulnerability Advisory

Vulnerability Key Information Summary 1. Vulnerability Overview Title: Community Package Install Validation Bypass via PubSub in Queue Mode Deployments Severity: High (CVSS Score: 7.5/10) Description: In deployments used for extensions (Queue Mode), the internal handler for installing community packages does not perform any of the checks present in the normal installation path (such as name and prefix validation, checks, checksum validation, and RPM safety checks). Impact: Any entity capable of writing to the Redis instance can download, install, and load arbitrary RPM packages to every n8n instance in the cluster, bypassing the requirement for an n8n account (an operation typically restricted to instance owners). 2. Affected Scope Affected Software: Affected Versions: 3. Remediation Official Patch: This issue has been fixed in the following versions; it is recommended to upgrade to these versions or later to eliminate the vulnerability: and above and above and above Temporary Workarounds: Restrict access to the Redis instance to only trusted n8n components using authentication and network-layer controls (firewall rules, private networks). Disable community package installation by setting , if community nodes are not required. Audit installed community packages for unexpected entries and remove them. Restrict access to n8n instances to trusted users only. 4. POC/Exploit Code Extraction Result**: No POC or exploit code was included in the screenshots.

Goal Reached Thanks to every supporter — we hit 100%!

n8n Queue Mode Community Package Installation Validation Bypass Vulnerability Advisory

More from this source