Which versions of N8n are affected by CVE-2026-27577?

A critical vulnerability in n8n workflow automation platform (CVSS 9.9) allows remote code execution through expression evaluation, potentially enabling attackers to compromise systems and access…. A patch is available.

How to fix or mitigate CVE-2026-27577?

Within 24 hours: Identify all n8n instances in production and development environments, verify current versions against affected versions (pre-2.10.1, pre-2.9.3, pre-1.123.22), and establish patch deployment schedule. Within 7 days: Apply available patches to all affected instances starting with production environments, with testing in staging environments first. Within 30 days: Complete patch deployment across all instances, document remediation completion, and review audit logs for signs of exploitation.

N8n CVE-2026-27577

Q: What is the CVSS score of CVE-2026-27577?

CVE-2026-27577 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

CRITICAL

Code Injection (CWE-94)

2026-02-25 security-advisories@github.com

GHSA-vpcf-gvg4-6qwr

RCE Code Injection N8n

9.4

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 28, 2026 - 05:27 vuln.today

Analysis Updated

Jul 28, 2026 - 05:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 28, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Jul 28, 2026 - 05:22 NVD

9.9 (CRITICAL) 9.4 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 04, 2026 - 14:00 nvd

Patch available

CVE Published

Feb 25, 2026 - 23:16 nvd

CRITICAL 9.9

DescriptionCVE.org

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

Authenticated remote code execution in n8n workflow automation platform (versions prior to 2.10.1, 2.9.3, and 1.123.22) allows low-privilege users with workflow creation or modification permissions to execute arbitrary system commands on the host. The vulnerability stems from insufficient isolation in the expression evaluation engine, where crafted expressions in workflow parameters can break out of the intended sandbox. Patches are available, no active exploitation has been reported, and the EPSS score of 0.15% indicates low current exploitation probability despite the critical CVSS rating.