Automation is no longer an addition, but an element of the company's infrastructure
A workflow built in n8n often has access to email, CRM, files, databases, forms, AI tools, financial systems and notifications. If someone takes over such a workflow, they do not have to break into each system separately. The attacker only needs to compromise the automation that already has the keys and permissions.
Administration panel
A public panel without MFA, SSO, VPN or IP allowlist increases the risk of environment hijacking.
Webhooks
Public endpoints must have secrets, validation, rate limiting, logs and an owner.
API tokens
Keys to CRM, email, AI and the cloud should be rotated, restricted and stored securely.
What the case of CVE-2025-68613 shows
CVE-2025-68613 concerns code execution through n8n expressions. Exploitation requires authenticated access that permits workflow configuration and can use the privileges of the n8n process. Restrict workflow creation and editing to trusted people; MFA does not replace patching.
Current version
Check the manufacturer's official advisories and update to the current stable version for your branch.
Exposure
Verify whether the panel, API and webhooks are accessible from the Internet and what security measures protect them.
After updating
Review logs, users, workflows, unusual requests and use of passwords and API keys during the risk period.
Evidence of activities
Maintain the version, revision date, decisions, review results, and corrective action list.
Versions, updates and when a single fix is not enough
The initial fix was identified in version 1.122.0. The later advisory GHSA-vpcf-gvg4-6qwr, dated 25 February 2026, describes further fixes to a related mechanism. These are historical references: at deployment, check all current vendor advisories and a supported version containing the required fixes.
- Check the n8n version, the date of the last update and the source of the container image or installation package.
- Verify that the admin panel is not publicly accessible without VPN, SSO, MFA or IP allowlist.
- After updating, review logs, users, workflows, webhooks and use of passwords and API keys during the risk period.
- Record evidence: version number, patch date, decisions, review results, and key rotation plan.
The second risk area: webhooks in phishing campaigns
A public webhook can serve legitimate forms or be abused for redirects and data collection. Such abuse does not establish exploitation of CVE-2025-68613. Assess the workflow and hosting model; for a cloud service, consult provider notices.
Fake file-sharing notification
The link may pretend to be OneDrive, Google Drive, an invoice, an HR document or a payment confirmation.
Bypassing filters
A webhook can generate an intermediate page that makes automatic analysis by email gateways difficult.
RMM as a backdoor
Legitimate remote management tools can be misused to retain access to a victim’s device.
Why does the problem not only affect large companies?
Automations are often implemented quickly: for forms, leads, documents, invoices, tickets, e-commerce, ERP, CRM and SaaS integrations. The risk increases when, after launch, no one is formally responsible for updates, user access, logs, backups, webhooks and storing API keys.
- A service company may stop customer service if a workflow with CRM or forms is hijacked or disabled.
- E-commerce risks interruption of payments, orders, logistics and notifications.
- Accounting offices, law firms and manufacturing companies process customer data, documents and operational processes through automation.
- Entities covered by NIS2, DORA or GDPR must treat automation as part of the IT environment, not as a side script.
What is worth checking in the n8n, Make, Zapier environment or your own automations?
Start with inventory and the following checklist. Review time depends on workflow count, integrations and available evidence. Unknown answers need an owner and risk-based follow-up.
- Version and hosting: current version, known hosting model, limited administration panel, TLS and access control.
- Identity: MFA or SSO, minimal roles, no shared accounts, periodic review of administrators.
- Webhooks: secrets, signatures, tokens, input validation, rate limiting, IP allowlist where possible.
- Secrets: API keys outside the workflow code, limited permission ranges, rotation and retirement of unused tokens.
- Logs and backup: central logging, unusual call alerts, configuration backup and workflow recovery test.
- Owners: Each workflow has a business owner, a technical owner, and a last review date.
Phased action plan for automation hardening
Handle a critical vulnerability promptly according to exposure and risk. Restrict access, preserve available incident evidence, arrange an urgent update and assess potential misuse of secrets. The following 30/60/90-day reviews maintain safeguards; they do not postpone incident response.
30-day review: exposure
Confirm complete inventory, remediation of urgent gaps and control of administrators and critical workflows.
60-day review: effectiveness
Check the effectiveness of permission limits, necessary token rotation, alerts and configuration recovery.
90-day review: maintenance
Review owners, recurring checks, change control, exceptions and current evidence of safeguard operation.
How does Virtline help secure automation?
We check n8n, Make, Zapier and our own API integrations as part of the infrastructure. We assess exposure, versions, administrator access, webhooks, secrets, logs, backups, workflow owners and the incident response path. The result is a short report with priorities, owners, risks and an action plan.
Mini automation audit
A quick overview of the most important risks without stopping the operational work of the team.
Hardening n8n
Configuration of the panel, access, webhooks, backup, logging and maintenance rules.
AI process security
Assessment of automations combining workflows, AI models, documents, customer data and company systems.
Summary
Process automation is not inherently dangerous, but a tool with access to email, CRM, documents, finances, customer data and APIs must be treated as part of the IT infrastructure. Vulnerabilities in n8n and phishing using webhooks show that the lack of updates, owners, logs, MFA and secret control can create a real backdoor.
Automation audit
We will check exposure, versions, webhooks, secrets, logs, backups and process owners.
n8n implementation
We design and maintain workflow automation with security control from the beginning.
Contact
Check the security of your automation before a public webhook or old token becomes an incident.
Primary sources for CVE-2025-68613
Check affected versions, fixes and recommendations in the current vendor advisories and CVE record.
n8n — advisory GHSA-v98v-ff95-f3cp
The vendor advisory describing the vulnerability, affected versions and fixes.
Open sourcen8n — follow-up advisory GHSA-vpcf-gvg4-6qwr
The later vendor advisory covering additional hardening and corrected versions.
Open sourceNVD — CVE-2025-68613
The vulnerability record in the US National Vulnerability Database.
Open sourceServices to verify next
If automation connects critical systems, it should be subject to the same supervision as email, VPN, CRM, backup and privileged accounts.
n8n implementation
Design, configuration and maintenance of workflow automation with security control.
Vulnerability management
Vendor advisory reviews, vulnerability prioritisation, updates and verification of completed fixes.
Contact
We will determine which workflows are critical and where automation may create risk.
Related automation security areas
n8n hardening depends on patching the platform, restricting ingress, rotating secrets, reviewing workflow privileges and monitoring unusual executions. The linked services cover those controls beyond the single CVE.
n8n automation
Workflow design with controlled access, secrets, logging and maintenance.
Cybersecurity
Review of exposure, vulnerabilities, permissions and incident response across the IT environment.
NIS2 audit
Assessment of security processes, responsibilities and evidence for regulated organisations.
Contact
Use the consultation to identify exposed panels, public webhooks, API tokens, workflow owners and the first hardening actions. Call +48 12 200 27 10 to arrange the review.
