N8n
CVE-2026-1470
CRITICAL
GHSA-5xrp-6693-jjx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to n8n instance
-
DeliveryCreate or edit workflow with malicious expression
-
ExploitSubmit expression in workflow configuration
-
ExecutionExpression evaluated in unisolated runtime context
-
ImpactArbitrary code executes as n8n process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account required on n8n instance. Attacker must have permissions to create or edit workflow expressions. Vulnerability exists in n8n's Expression evaluation system when processing user-supplied expressions during workflow configuration. |
| Impact | CVSS 9.9 with PoC and patch. n8n now has five critical RCE paths. The platform's code execution model requires fundamental security redesign. |
| Exploit ScenarioDerived | An attacker crafts a workflow expression that injects code through the evaluator, achieving RCE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through crafted workflow expressions.
Earlier versions of this analysis (1)
Fifth n8n RCE — expression evaluator code injection.
RemediationAI
Update n8n. All five RCE vulnerabilities must be addressed.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
n8n has a CWE-95 eval injection in the workflow Expression evaluator. Fifth critical n8n vulnerability discovered.
Know when N8n gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.
An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.
Executive ViewAI
n8n installations face critical remote code execution risk through workflow expressions, allowing authenticated users to execute arbitrary code on affected servers. Immediate patching is required to prevent potential data breach, system compromise, and operational disruption across all n8n deployments in your environment.
Apply vendor patch. If immediate patching is not possible: (1) Restrict workflow configuration access to trusted administrators only; (2) Disable expression evaluation features if operationally feasible; (3) Implement network segmentation to limit n8n server lateral movement capability; (4) Deploy WAF rules to monitor and restrict unusual expression syntax; (5) Enable comprehensive audit logging of all workflow modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
Authenticated users who can create or modify an n8n workflow can achieve remote code execution on the n8n host by abusin
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
Exploit-DB