CVE-2026-126387: n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool

Q: Who can exploit this issue?

An authenticated n8n member can exploit it if they have a connected remote browser session and can use the Browser Use browser_upload tool.

Q: What access does an attacker need to retrieve files?

The attacker needs valid member-level authentication and a connected remote browser session. Exploitation requires supplying an absolute server path to the browser_upload tool, causing Playwright to read the file and expose its contents through the page.

Q: Which deployments are affected?

n8n versions before 2.46.1 are affected when the Browser Use browser_upload capability is available with a connected remote browser session.

Q: What is the remediation?

Upgrade n8n to version 2.46.1 or later. The provided information does not specify a workaround for environments that cannot immediately upgrade.

Published Nov 13, 2026

Updated

n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browserupload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page.

Affected Software

1 affected component

n8n n8n<2.46.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade n8n to a version that resolves this vulnerability.
Fixed in 2.46.1

Event History

Nov 13, 2026

CVE Published

via MITRE·09:35 AM

Data Sourced

via MITRE·09:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated n8n member can exploit it if they have a connected remote browser session and can use the Browser Use browser_upload tool.

What access does an attacker need to retrieve files?

The attacker needs valid member-level authentication and a connected remote browser session. Exploitation requires supplying an absolute server path to the browser_upload tool, causing Playwright to read the file and expose its contents through the page.

Which deployments are affected?

n8n versions before 2.46.1 are affected when the Browser Use browser_upload capability is available with a connected remote browser session.

What is the remediation?

Upgrade n8n to version 2.46.1 or later. The provided information does not specify a workaround for environments that cannot immediately upgrade.

CVE-2026-126387: n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to retrieve files?

Which deployments are affected?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to retrieve files?

Which deployments are affected?

What is the remediation?