N8n
CVE-2026-27494
CRITICAL
GHSA-mmgg-m5j7-f83h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to n8n instance
-
ExploitCreate or modify workflow with Python Code node
-
ExecutionAccess unrestricted built-in Python objects
-
ImpactExecute arbitrary code on host or task runner
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | Authenticated user account with workflow creation/modification permissions on n8n instance prior to versions 2.10.1, 2.9.3, or 1.123.22. Python Code node execution capability required. Default internal Task Runner mode exposes full host compromise; external Task Runners expose other task environments. |
| Impact | CVSS 9.9 with scope change. n8n with internal Task Runners (default mode) — sandbox escape provides full host access. |
| Exploit ScenarioDerived | Authenticated user with workflow edit access creates Python Code node that escapes sandbox, reads files (API keys, database credentials), or executes commands on the n8n host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Python sandbox escape in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Users who can modify workflows can escape the Python Code node sandbox for full host compromise on instances using internal Task Runners.
Earlier versions of this analysis (1)
Python sandbox escape in n8n Code node.
RemediationAI
Update n8n. Consider using external Task Runners to limit blast radius of sandbox escapes.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-497 information exposure. The Python Code node sandbox does not sufficiently restrict access to Python built-in objects, allowing file exfiltration or RCE. On internal Task Runner mode (default), this compromises the host.
Know when N8n gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the Python Code node to escape the sandbox. The sandbox did not sufficiently restrict access to certain built-in Python objects, allowing an attacker to exfiltrate file contents or achieve RCE. On instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner. Task Runners must be enabled using N8N_RUNNERS_ENABLED=true. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only., and/or disable the Code node by adding n8n-nodes-base.code to the NODES_EXCLUDE environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Executive ViewAI
N8N versions 2.10.1 and earlier contain a critical vulnerability (CVSS 9.9) that allows complete compromise of affected hosts. Any organization running vulnerable N8N instances faces immediate risk of data breach, system takeover, and operational disruption until mitigation is implemented.
Network segmentation (restrict N8N to trusted networks only); WAF rules blocking suspicious N8N traffic patterns; disable N8N workflows until patched; restrict N8N API access via IP allowlisting; implement enhanced monitoring and alerting on N8N processes; run N8N in restricted container with minimal privileges; monitor vendor advisories for patch availability and apply immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Authenticated users who can create or modify an n8n workflow can achieve remote code execution on the n8n host by abusin
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
Exploit-DB