internet-facing-service-vulnerabilitywidely-deployed-product-advisorygovernment-diplomatic-threat

Critical n8n Vulnerabilities Enabling RCE and Sandbox Escapes

Vulnerability Disclosure · 40 sources · Updated 2mo ago · First seen Feb 27, 2026

Government cyber agencies in Belgium and Canada warned that n8n released security updates to address multiple critical vulnerabilities that could allow attackers to compromise workflow automation instances, particularly those exposed to the internet. The advisories emphasize that n8n often orchestrates actions across interconnected systems, increasing blast radius if compromised, and urge administrators to patch immediately to protect confidentiality, integrity, and availability.

The Belgian CCB advisory highlights three critical CVEs—CVE-2026-27495, CVE-2026-27577, and CVE-2026-27497 (each scored CVSS 9.4) affecting n8n versions prior to 2.10.1 / 2.9.3 / 1.123.22, including issues mapped to CWE-94 (code injection) and CWE-89 (SQL injection). It describes sandbox escape leading to arbitrary code execution in the JavaScript Task Runner (notably impacting the default internal Task Runner mode) and abuse of crafted workflow expressions by authenticated users with workflow modification permissions; Canada’s Cyber Centre advisory (AV26-176) additionally enumerates impacted components and attack classes including RCE via Merge Node, expression sandbox escape to RCE, JavaScript Task Runner sandbox escape, unauthenticated expression evaluation via Form Node, and stored XSS across multiple nodes, directing organizations to apply n8n’s upstream fixes.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

21 events · Oct 8, 2025 – Jul 22, 2026

Jul 22, 20264mo ago
n8n patches new expression sandbox-escape vulnerability
On 2026-07-22, n8n released versions 2.31.5 and 2.32.1 to fix GHSA-gv7g-jm28-cr3m, a high-severity expression-sandbox escape that let authenticated workflow editors execute OS commands on the host as the n8n process. Security Joes said the flaw was found while investigating a bypass related to CVE-2026-27577 and warned it could expose the N8N_ENCRYPTION_KEY and stored credentials.
n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
May 18, 20266mo ago
Researchers disclose three critical n8n node flaws enabling chained RCE
Researchers disclosed three critical n8n vulnerabilities—CVE-2026-44789, CVE-2026-44790, and CVE-2026-44791—affecting the HTTP Request, Git, and XML nodes that low-privileged authenticated users with workflow editing rights could chain to achieve remote code execution. The issues were fixed in versions 1.123.43, 2.20.7, and 2.22.1 and later, with organizations urged to upgrade immediately because no complete workaround exists.
Critical n8n Vulnerabilities Expose Automation Nodes to Full RCE
May 13, 20266mo ago
Canada issues advisory on May n8n security updates
On 2026-05-13, the Canadian Centre for Cyber Security published advisory AV26-459 covering newly released n8n security advisories for multiple critical vulnerabilities. The advisory said affected areas included Pagination Prototype Pollution, Dynamic Credential OAuth Endpoints, Source Control, XML Node Prototype Pollution, and Git Node, and urged users and administrators to review and apply updates.
n8n security advisory (AV26-459) - Canadian Centre for Cyber Security
Apr 22, 20267mo ago
Canada issues advisory on April n8n security updates
On 2026-04-22, the Canadian Centre for Cyber Security published advisory AV26-379 covering newly released n8n security advisories for multiple vulnerabilities, including some rated critical. The advisory said affected areas included MCP Client Registration, dynamic-node-parameters, XML Node Prototype Pollution, XML Webhook, SQL Mode of Merge Node, MCP OAuth client, and Python Task Runner, and urged users to review and apply updates.
n8n security advisory (AV26-379) - Canadian Centre for Cyber Security
Mar 25, 20267mo ago
Canada issues advisory on new n8n security updates
On 2026-03-25, the Canadian Centre for Cyber Security published advisory AV26-278 covering newly released n8n security updates for multiple components and editions, including the Merge Node, Community Edition, Binary Data Inline HTML Rendering, GSuiteAdmin Node, and Form Trigger/Chat Trigger Nodes. The advisory urged users and administrators to review n8n's security information and apply the necessary updates.
n8n security advisory (AV26-278) - Canadian Centre for Cyber Security
Reported Mar 19, 20268mo ago
Researchers detail n8n TOCTOU file-read flaw enabling owner-account takeover
Researchers detailed an authenticated TOCTOU symlink-race vulnerability in n8n's Read/Write Files from Disk functionality, which could be triggered with the Git node to read files accessible to the n8n process. The demonstrated attack could obtain the encryption key and SQLite user data, forge a session JWT, and take over an owner account; n8n's final fix was included in versions 1.123.18 and 2.5.0.
Authenticated Arbitrary File Read via Race Condition leads to 0-Click Account Take Over on n8n | Critical Thinking - Bug Bounty Podcast
Mar 11, 20268mo ago
Pillar Security discloses four critical n8n flaws
On 2026-03-11, Pillar Security publicly detailed four critical n8n vulnerabilities, including CVE-2026-27577 and CVE-2026-27493, which can be exploited individually or chained for remote code execution. The disclosure also warned that attackers could extract the N8N_ENCRYPTION_KEY and decrypt stored credentials such as API keys, OAuth tokens, and database passwords.
Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
Feb 27, 20268mo ago
Belgium warns users to patch critical n8n vulnerabilities immediately
On February 27, 2026, Belgium's Centre for Cybersecurity published an advisory warning about multiple critical vulnerabilities in n8n and urging immediate patching. This reflects broader government dissemination of the February n8n security issues.
Feb 25, 20268mo ago
n8n releases security updates for multiple critical flaws
On February 25, 2026, n8n released security updates addressing multiple critical vulnerabilities across several components and nodes, including RCE via the Merge Node, sandbox escapes, unauthenticated expression evaluation via the Form Node, and stored XSS issues. Users and administrators were advised to review the advisories and update affected versions.
Feb 4, 20269mo ago
n8n publishes advisory for arbitrary file read by authenticated users
On 2026-02-04, n8n published a GitHub security advisory for an improper file access controls vulnerability that allowed authenticated users to read arbitrary files. This was a separate vendor disclosure from the other n8n advisories and third-party research released the same day.
Improper File Access Controls Allow Arbitrary File Read by Authenticated Users · Advisory · n8n-io/n8n · GitHub
Feb 4, 20269mo ago
n8n publishes Community Package Installation command injection advisory
On 2026-02-04, n8n published a GitHub security advisory for a command injection vulnerability affecting Community Package Installation. The advisory introduced a separate flaw from the same day's SSH Node arbitrary file write issue and Pillar Security's sandbox-escape disclosures.
Command Injection in Community Package Installation · Advisory · n8n-io/n8n · GitHub
Feb 4, 20269mo ago
Pillar Security discloses critical n8n sandbox-escape flaws
On 2026-02-04, Pillar Security publicly disclosed two critical sandbox-escape vulnerabilities in n8n, including CVE-2026-25049, that allowed authenticated workflow editors to achieve remote code execution and compromise self-hosted and cloud deployments. The report said n8n acknowledged the issues, rotated secrets, and later delivered a comprehensive fix in version 2.4.0 after an initial December 2025 fix was bypassed.
n8n Sandbox Escape: Critical Vulnerabilities in n8n Exposes Hundreds of Thousands of Enterprise AI Systems to Complete Takeover
Feb 4, 20269mo ago
n8n publishes SSH Node arbitrary file write advisory
On 2026-02-04, n8n published a GitHub security advisory for an Arbitrary File Write vulnerability affecting the SSH Node that could enable writes on remote systems. This was a separate vendor advisory distinct from the same-day Pillar Security sandbox-escape disclosure and preceded the broader February security update roundup.
Arbitrary File Write on Remote Systems via SSH Node · Advisory · n8n-io/n8n · GitHub
Jan 27, 20269mo ago
JFrog discloses n8n Expression Node remote code execution flaw
On 2026-01-27, JFrog Security Research published a disclosure about a remote code execution vulnerability affecting n8n's Expression Node. The report introduced a distinct technical disclosure separate from earlier January PoC reporting and later February sandbox-escape disclosures.
n8n Expression Node RCE | JFSA-2026-001651697 - JFrog Security Research
Jan 12, 202610mo ago
Canada issues alert on high-severity n8n vulnerabilities
On January 12, 2026, the Canadian Centre for Cyber Security published Alert AL26-001 warning about CVE-2026-21858, CVE-2026-21877, and CVE-2025-68613 affecting the n8n workflow automation platform. The alert described risks including arbitrary code execution and arbitrary file writes, and urged organizations to upgrade or restrict exposed webhook and form endpoints.
Jan 12, 202610mo ago
Public PoCs emerge for critical n8n vulnerabilities
Public proof-of-concept exploits became available for multiple n8n flaws, including a chain using CVE-2026-21858 and CVE-2025-68613 to achieve unauthenticated remote code execution by extracting sensitive data and executing commands on the server.
Jan 8, 202610mo ago
Critical unauthenticated n8n server-takeover flaw publicly reported
On 2026-01-08, public reporting highlighted a critical n8n vulnerability that could allow unauthenticated attackers to take over exposed servers. This represents an earlier public disclosure of the flaw later reflected in subsequent PoC activity and government warnings.
Critical n8n bug allows unauthenticated server takeover
Dec 26, 202510mo ago
Public GitHub PoC released for CVE-2025-68613 in n8n
On 2025-12-26, a public GitHub repository published exploit code, scanning tools, and research for CVE-2025-68613, a critical expression-injection flaw in n8n. The release made practical exploitation guidance publicly available ahead of later broader reporting on multiple n8n PoCs.
GitHub - TheStingR/CVE-2025-68613-POC: Public PoC + Scanner and research for CVE-2025-68613: Critical RCE in n8n Workflow Automation via Expression Injection (CVSS 10.0). Includes detection tools, full exploit, and remediation guidance. · GitHub
Dec 24, 202511mo ago
n8n publishes advisory for Legacy Code node file read/write flaw
On 2025-12-24, n8n published a GitHub security advisory for a vulnerability in the Legacy Code node that could enable file read and write access in self-hosted deployments. The advisory introduced a distinct security issue not reflected in the existing timeline entries.
Legacy Code node enables file read/write in self-hosted n8n · Advisory · n8n-io/n8n · GitHub
Oct 30, 20251y ago
n8n publishes advisory for Git Node pre-commit hook RCE
On 2025-10-30, n8n published a GitHub security advisory for a remote code execution vulnerability in the Git Node involving the pre-commit hook. The advisory represents an earlier distinct disclosure affecting n8n and is separate from later multi-node critical flaw reports.
Remote Code Execution via Git Node Pre-Commit Hook · Advisory · n8n-io/n8n · GitHub
Oct 8, 20251y ago
n8n publishes Execute Command node security advisory
On 2025-10-08, n8n published a GitHub security advisory warning that the Execute Command node allows authenticated users to run arbitrary commands on the host system when the node is enabled. The advisory said n8n.cloud is not affected and recommended disabling the node by default or blocking it with the NODES_EXCLUDE environment variable rather than issuing a code patch.
Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host · Advisory · n8n-io/n8n · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

Sandbox Escape in n8n JavaScript Task Runner (CVE-2026-27495)Remote Code Execution in n8n Merge Node SQL Query Mode (CVE-2026-27497)n8n Expression Sandbox Escape Remote Code Execution (CVE-2026-27577)

Affected products

1 linked

N8n

Organizations

1 linked

N8n

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

40 references tracked. Mallory keeps watching after this page renders.

The Hacker NewsNews · Jul 27, 2026

n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n ProcessOpen source ↗

Cyber Security NewsNews · May 18, 2026

Critical n8n Vulnerabilities Expose Automation Nodes to Full RCEOpen source ↗

Ca CcsNews · May 13, 2026

n8n security advisory (AV26-459) - Canadian Centre for Cyber SecurityOpen source ↗

Github Advisories Github LinkNews · May 13, 2026

Arbitrary File Read via Git Node · Advisory · n8n-io/n8n · GitHubOpen source ↗

32 additional sources from 08-01-2026 to 13-05-2026

Github WebNews · Dec 26, 2025

GitHub - TheStingR/CVE-2025-68613-POC: Public PoC + Scanner and research for CVE-2025-68613: Critical RCE in n8n Workflow Automation via Expression Injection (CVSS 10.0). Includes detection tools, full exploit, and remediation guidance. · GitHubOpen source ↗

Github Advisories Github LinkNews · Dec 24, 2025

Legacy Code node enables file read/write in self-hosted n8n · Advisory · n8n-io/n8n · GitHubOpen source ↗

Github Advisories Github LinkNews · Oct 30, 2025

Remote Code Execution via Git Node Pre-Commit Hook · Advisory · n8n-io/n8n · GitHubOpen source ↗

Github Advisories Github LinkNews · Oct 8, 2025

Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host · Advisory · n8n-io/n8n · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News