Which versions of n8n are affected by CVE-2026-49444?

An authenticated vulnerability in n8n's Python Task Runner component allows users with workflow editing privileges to execute arbitrary code on the task runner container, creating a foothold for…. A patch is available.

How to fix or mitigate CVE-2026-49444?

24 hours: Identify deployments with Python Task Runner enabled; restrict 'workflow edit' role to only trusted administrators. 7 days: Apply vendor patches-upgrade to n8n 1.123.48 (LTS), 2.21.8, or 2.22.4 depending on your version line. 30 days: Confirm patch deployment in production; audit workflow editor role membership and review Python Task Runner execution logs for suspicious activity.

n8n CVE-2026-49444

Q: What is the CVSS score of CVE-2026-49444?

CVE-2026-49444 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38481 HIGH

Improper Input Validation (CWE-20)

2026-06-16 https://github.com/n8n-io/n8n

GHSA-9pq8-m8gp-4p53

Python RCE

7.1

CVSS 4.0 · Vendor: https://github.com/n8n-io/n8n

Severity by source

Vendor (https://github.com/n8n-io/n8n) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable n8n UI/API with authenticated low-priv account (PR:L), no user interaction, sandbox escape yields full code execution in runner container so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/n8n-io/n8n).

CVSS VectorVendor: https://github.com/n8n-io/n8n

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 18:45 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 18:44 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 18:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 18:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jun 23, 2026 - 18:22 NVD

8.5 (HIGH) 7.1 (HIGH)

Source Code Evidence Fetched

Jun 16, 2026 - 18:23 vuln.today

Analysis Generated

Jun 16, 2026 - 18:23 vuln.today

DescriptionCVE.org

Impact

An authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container.

This issue only affects instances where the Python Task Runner is enabled.

Patches

The issue has been fixed in n8n versions 1.123.48, 2.21.8, and 2.22.4. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Disable the Python Code node by adding n8n-nodes-base.code to the NODES_EXCLUDE environment variable, or disable the Python Task Runner entirely.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Articles & Coverage 1

News 6 New Python Vulnerabilities - 2 Critical, 4 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in n8n workflow automation platform allows authenticated users with workflow edit privileges to execute arbitrary code on the Python Task Runner container via a crafted Python Code Node. The flaw affects n8n versions prior to 1.123.48, 2.21.8, and 2.22.4 when the optional Python Task Runner is enabled, and no public exploit identified at time of analysis. Successful exploitation grants code execution inside the task runner container, providing a foothold for further lateral movement within the n8n deployment.

Technical ContextAI

n8n is a popular open-source workflow automation platform (pkg:npm/n8n) that allows users to compose pipelines from reusable nodes, including a Python Code Node executed inside a dedicated Python Task Runner container. To safely execute user-supplied scripts, n8n relies on a sandboxing layer that restricts access to host resources and the underlying interpreter. This issue is classified as CWE-20 (Improper Input Validation), indicating that the Python Code Node fails to adequately validate or restrict script constructs, permitting an attacker to break out of the sandbox abstraction and run arbitrary Python in the runner container's process context.

RemediationAI

Vendor-released patches are available - upgrade n8n to 1.123.48, 2.21.8, or 2.22.4 (or any later release on the respective branch) per advisory GHSA-9pq8-m8gp-4p53 at https://github.com/n8n-io/n8n/security/advisories/GHSA-9pq8-m8gp-4p53. If immediate upgrade is not possible, disable the Python Code node by adding n8n-nodes-base.code to the NODES_EXCLUDE environment variable, or disable the Python Task Runner entirely - the trade-off is that any existing workflows depending on Python execution will break and must be re-implemented using JavaScript or external services. As an additional administrative control, restrict workflow create/edit permissions to fully trusted operators, accepting that this reduces self-service automation across teams; the vendor explicitly notes these mitigations are partial and do not fully remediate the underlying sandbox escape.