n8n CVE-2026-77072

Exploitation requires the attacker to hold a low-privileged authenticated account on the target n8n instance with permission to create or edit workflows. The Form node's respondWith field must be set to 'redirect' via a dynamic expression - this specific configuration is what disables the CSP sandbox while still allowing responseText HTML rendering, which is the precise bypass mechanism. A victim must actively submit the public form (user interaction required, per UI:A in the CVSS vector). Exploitation is bounded by: (1) attacker must have workflow-author access - instances where only administrators can create workflows are not exploitable by external or low-trust actors; (2) a form submission event from a victim is required; (3) the victim must have an active n8n session for session-based impact to apply, though script execution occurs regardless.

The CVSS 4.0 score of 8.4 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N) accurately reflects the attack's realistic profile: low complexity and network-accessible, but gated behind a low-privileged authenticated account (PR:L) and requiring a victim to submit the form (UI:A). The high confidentiality and integrity ratings on the vulnerable system reflect the same-origin script execution scope, which enables full session compromise. There is no CISA KEV listing and no EPSS data was provided in the source intelligence, making it impossible to quantify current exploitation probability numerically - the real-world risk is therefore driven by threat-actor access to n8n member accounts rather than opportunistic internet-wide scanning. Organizations running n8n instances where untrusted or semi-trusted collaborators can create workflows face meaningfully higher exposure than those with tightly controlled admin-only workflow authoring. No conflicting signals exist between the CVSS vector and the description.

A low-privileged n8n workspace member crafts a workflow in which a Form node uses a dynamic expression to set respondWith to 'redirect' while embedding a JavaScript payload in responseText. The public form URL is distributed to targets; when a victim submits the form, the completion page renders the attacker's script without CSP protection in the n8n origin, allowing the attacker to exfiltrate the victim's n8n session token. No public proof-of-concept code has been identified, but the vulnerability class is well-understood and the bypass mechanism is straightforward to replicate from the advisory description.