n8n CVE-2026-65591

Exploitation requires an authenticated n8n account with workflow create or modify permissions (CVSS PR:L) and that the target run the legacy expression evaluator, which is the default engine in affected versions - so default deployments are vulnerable, but only to users who can author or edit workflows. The CVSS 4.0 vector also sets AT:P, indicating an additional attack requirement/condition must be met for the sanitizer-bypass in the computed-member handler to succeed. Limiting factors that reduce real-world risk: the attacker cannot be fully unauthenticated (an account with edit rights is mandatory), deployments that have moved off the legacy engine or that lock down workflow-editing RBAC are not reachable, and the attack-requirement (AT:P) means it is not a guaranteed single-shot trigger. No user interaction from a victim is needed (UI:N).

This is a genuine priority rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) shows network reachability, low complexity, and no user interaction, tempered by two real limiting factors: AT:P (a specific attack requirement/condition applies) and PR:L (the attacker must already hold an authenticated account with workflow create/modify rights). The impact metrics are severe and consistent - VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H (SA:L) - reflecting full compromise of the host and potential lateral impact, which justifies the 8.9 score. No EPSS score, KEV listing, or public POC was provided, so exploitation is not confirmed in the wild; the risk is driven by the low bar for an already-authenticated user and the fact that the vulnerable engine is the default. The chief mitigating reality is the privilege prerequisite: in n8n deployments where workflow editing is tightly restricted, exposure is much narrower than the network vector alone implies.

An attacker who has been granted (or has phished/compromised) an account with workflow edit rights creates or edits a workflow and inserts a specially crafted expression whose computed-member access evades the legacy evaluator's sanitizer. When the expression is evaluated, it executes attacker-controlled code as the n8n process, giving the attacker a foothold on the host. No public POC has been identified at time of analysis, but the low attack complexity means a working exploit would be straightforward once the bypass technique is known.