Maximum-severity n8n flaw lets randos run your automation server

A maximum-severity bug in the popular automation platform n8n has left an estimated 100,000 servers wide open to complete takeover, courtesy of a flaw so bad it doesn't even require logging in. The vulnerability, uncovered by researchers at security outfit Cyera, carries a CVSS score of 10.0 and has been dubbed "ni8mare" for …

[SVD_NL]

Good lord...

"Let's authenticate this one product running LLMs and accepting user input/commands to every single software product in our environment with highly privileged permissions!"

Am i the only one seeing the issue here?

[Anonymous Coward]

Re: Good lord...

imo n8n transparently describes itself to be vulnerability-as-a-service so the announcement seems on-brand.

[Doctor Syntax]

Re: Good lord...

The more you dig into it...

Npm, Javascript, DevOps, Low-code/No-code building. No, nothing to go wrong there.

They have what's termed a SOC 3 report on security. AIUI what this says is that N8N makes assertions about what it does and the auditor confirms that N8N makes its assertions. There seems to be no audit on the product, just an audit on the paperwork.

[Anonymous Coward]

popular automation platform

Never heard of it

[Anonymous Coward]

Not a flaw

> lets randos run your automation server

But an opportunity to streamline the headcount.

[m4r35n357]

Am I doing something wrong?

I run a home "server", which is accessed by various client machines using key-based SSH.

That "server" does NOT have any access to the clients; do I need to fix it?

[Anonymous Coward]

Re: Am I doing something wrong?

> do I need to fix it?

It can be improved.

I run mine on a Linux 1.6 kernel over telnet with a passwordless root account. Hackers assume it's a honeypot and stay away from it.

[John_Ericsson]

Re: Am I doing something wrong?

If it is not already done, can I suggest you name the server "bitcoin".

[TimMaher]

Randos

I misread that as Nandos.

Sounds like they may do a better job.

[SVD_NL]

Re: Nandos

RCE - Remote Chicken Enhancement

[harrys]

amazing application

self hosted and used for automating internal workflows, and over overlay networks

wouldnt dream off opening it to the great unwashed, madness!

with great power comes great responsibility :)

[Anonymous Coward]

Why ni8mare instead of n8mare? ni8mare is unnecessarily hard to say.