Severe n8n Vulnerabilities Enable Remote Code Execution and Credential Exposure

Cybersecurity researchers have revealed details of two recently patched vulnerabilities in the n8n workflow automation platform, including a pair of critical flaws that could enable arbitrary command execution.

The disclosed vulnerabilities are as follows:

• CVE-2026-27577 (CVSS: 9.4)   An expression sandbox escape that can lead to remote code execution (RCE)
• CVE-2026-27493 (CVSS: 9.5)   Unauthenticated expression evaluation through n8n’s Form nodes

“CVE-2026-27577 is a sandbox escape in the expression compiler,” said Eilon Cohen, a researcher at Pillar Security who discovered and reported the issues, in a report shared with The Hacker News. “A missing case in the AST rewriter allows process to pass through unmodified, granting any authenticated expression full remote code execution.”

Pillar Security described CVE-2026-27493 as a “double‑evaluation bug” affecting n8n’s Form nodes. The flaw can be exploited for expression injection because form endpoints are intentionally public and require neither authentication nor an n8n account.

Successful exploitation requires only a publicly accessible “Contact Us” form. By submitting a crafted payload in the Name field, an attacker can execute arbitrary shell commands.

In an advisory released late last month, n8n stated that CVE-2026-27577 could be abused by an authenticated user with permission to create or modify workflows. By crafting malicious expressions in workflow parameters, such a user could trigger unintended system command execution on the n8n host.

The company further noted that CVE-2026-27493, when chained with an expression sandbox escape such as CVE-2026-27577, could escalate into full remote code execution on the underlying system.

Both vulnerabilities impact self‑hosted and cloud deployments of n8n. Affected versions include:

• Versions earlier than 1.123.22
• Versions 2.0.0 to 2.9.2
• Versions 2.10.0

The issues have been fixed in n8n versions 1.123.22, 2.9.3, and 2.10.1.

If immediate patching of CVE-2026-27577 is not possible, users are advised to restrict workflow creation and modification privileges to fully trusted users. n8n also recommends deploying the platform in a hardened environment with limited operating system permissions and restricted network access.

For CVE-2026-27493, n8n recommends the following mitigations:

• Manually review Form node usage to confirm exposure conditions
• Disable the Form node by adding n8n-nodes-base.form to the NODES_EXCLUDE environment variable
• Disable the Form Trigger node by adding n8n-nodes-base.formTrigger to the NODES_EXCLUDE environment variable

“These workarounds do not fully eliminate the risk and should only be used as temporary mitigation measures,” the maintainers cautioned.

According to Pillar Security, successful exploitation of these flaws could allow attackers to read the N8N_ENCRYPTION_KEY environment variable. With this key, an attacker could decrypt all credentials stored in n8n’s database, including AWS credentials, database passwords, OAuth tokens, and API keys.

The same patched versions 2.10.1, 2.9.3, and 1.123.22 also address two additional critical vulnerabilities that could likewise be leveraged for arbitrary code execution:

• CVE-2026-27495 (CVSS: 9.4)   A code injection flaw in the JavaScript Task Runner sandbox allowing authenticated users to execute code outside the sandbox boundary
• CVE-2026-27497 (CVSS: 9.4)  A vulnerability in the Merge node’s SQL query mode that enables authenticated users to execute arbitrary code and write files to the n8n server

To mitigate these risks, n8n recommends limiting workflow permissions to trusted users and applying the following workarounds:

• CVE-2026-27495 – Enable external runner mode by setting N8N_RUNNERS_MODE=external to reduce impact
• CVE-2026-27497 – Disable the Merge node by adding n8n-nodes-base.merge to the NODES_EXCLUDE environment variable

While n8n has not indicated that any of these vulnerabilities are being actively exploited in the wild, users are strongly encouraged to keep their installations fully up to date to ensure maximum protection.