Critical RCE and security-bypass vulnerabilities in n8n workflow automation platform

Researchers reported critical vulnerabilities in the n8n low-code workflow automation platform that can enable host-level compromise. The issues include CVE-2026-1470 (CVSS 9.9) and CVE-2026-0863 (CVSS 8.5), described as allowing attackers to bypass security controls, achieve arbitrary code execution, and potentially obtain full control of n8n services, with downstream exposure of credentials, API keys, and other sensitive data. Impact spans cloud deployments as well as self-hosted instances that have not been patched.

Given n8n’s common use to integrate SaaS services and increasingly to orchestrate LLM-enabled business workflows, successful exploitation could provide broad access to connected systems and secrets stored in workflows. Coverage also noted the disclosures follow an earlier, separate critical n8n issue reported in late 2025, reinforcing the need for tighter vulnerability management around automation/orchestration tooling. Organizations were urged to upgrade to patched versions and review hardening controls for n8n deployments, particularly where the platform has access to high-privilege tokens and production integrations.