Summary
A validation bypass in n8n's community package installation handler can allow arbitrary npm packages to be installed across queue-mode cluster instances. The issue becomes risky when an attacker has write access to the Redis backend, even without application authentication.
Affected context
The vulnerability occurs in n8n queue-mode deployments that use Redis for coordination and expose a Redis write path to an attacker. In affected release ranges, the community package installation workflow may accept requests that bypass package-name validation, permission checks, checksum verification, and npm safety controls before distributing the package across cluster instances.
Exploit preconditions
- Attack surface: The queue-mode community package installation handler and its Redis-backed coordination workflow
- Required access: Ability to write to the relevant Redis data or commands; application authentication is not required when this access is available
- Trigger point: Processing of a community package installation request in a queue-mode deployment
- Why exploitation is possible: Authorization and package-safety validation can be bypassed, allowing an arbitrary npm package to be propagated to cluster instances
Why this happens
The underlying issue is an authorization enforcement failure mapped to CWE-862: Missing Authorization. The package installation path does not consistently enforce permission and validation requirements before acting on installation data received through the Redis-backed workflow. As a result, an attacker with access to the coordination channel may cause package installation without satisfying the intended authorization, integrity, and safety checks.
Potential impact
- Arbitrary npm packages may be installed across queue-mode cluster instances
- Malicious package code could execute within n8n worker or application processes
- Workflow credentials, secrets, or connected-service access could be exposed
- Cluster integrity and software supply-chain trust could be weakened
- Attackers could cause service disruption or use compromised instances for lateral movement
General mitigation guidance
Mitigation generally focuses on enforcing authorization and package integrity at every installation boundary.
Common defensive patterns include:
- Require authenticated, explicitly authorized package-installation requests
- Treat Redis as a privileged internal service and restrict write access by network policy and access controls
- Apply consistent package-name allowlists, checksum verification, and npm safety checks before installation
- Validate and authorize requests independently on each cluster instance rather than trusting coordination messages
- Run n8n workers with least privilege and isolate package installation from sensitive host and service resources
- Prefer secure-by-default package policies that disable community package installation unless it is explicitly needed
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis and code review of authorization checks around package installation handlers
- Tests confirming that Redis-originated installation requests cannot bypass authentication, permission, integrity, or safety validation
- Monitoring for unexpected Redis writes and package-installation events across queue workers
- Allowlist and policy enforcement for npm package names, versions, registries, and checksums
- Audit logs correlating package installation activity with authorized administrative actions
- Automated security review tools that flag missing authorization checks and trust of internal message-bus inputs
