Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0863 | Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python cod Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact. NVD description · AI analysis pending | 9.9 | 9% | PoC ×2 |
| — | |
| CVE-2026-1470 | n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. NVD description · AI analysis pending | 9.9 | 19% | PoC |
| — | |
| CVE-2026-21858 | Unauthenticated RCE in n8n Workflow Automation (Ni8mare) n8n versions 1.65.0 through below 1.121.0 contain an input-validation flaw (CWE-20) in the handling of certain form-based workflows, allowing an unauthenticated remote attacker to reach the underlying server through form endpoints. By triggering a vulnerable form workflow, the attacker can access files on the host and expose sensitive information stored there; the Cyera research team (which named the bug "Ni8mare") and the CVSS 10.0 score with high integrity impact indicate this yields unauthenticated remote code execution and potential full takeover. Any self-hosted n8n instance running an affected version that exposes form-based workflows over the network is at risk, with blast radius amplified by n8n's typical access to credentials, secrets, and connected internal systems. The issue is fixed in version 1.121.0; the flaw is not yet in CISA's KEV, but a public proof-of-concept is available and EPSS assigns a 78.4% probability of exploitation within 30 days, so defenders should treat exploitation as likely and imminent. Do: Upgrade n8n to version 1.121.0 or later immediately. If you cannot upgrade right away, check whether any workflows use form triggers and remove those form endpoints from untrusted network exposure — place them behind authentication, a reverse proxy, or an IP allowlist. Review instance logs for unexpected requests to form/webhook paths and unusual file access, given the high EPSS score and public proof-of-concept. | 10.0 | 78% | PoC ×2 |
| large≈50,000–100,000 internet-exposed n8n servers (self-hosted automation platform, affected range spans roughly a year of releases) |
Full article464 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 28, 2026Vulnerability / Workflow Automation
Cybersecurity researchers have disclosed two new security flaws in the n8n workflow automation platform, including a crucial vulnerability that could result in remote code execution.
The weaknesses, discovered by the JFrog Security Research team, are listed below -
- CVE-2026-1470 (CVSS score: 9.9) - An eval injection vulnerability that could allow an authenticated user to bypass the Expression sandbox mechanism and achieve full remote code execution on n8n's main node by passing specially crafted JavaScript code
- CVE-2026-0863 (CVSS score: 8.5) - An eval injection vulnerability that could allow an authenticated user to bypass n8n's python-task-executor sandbox restrictions and run arbitrary Python code on the underlying operating system
Shachar Menashe, JFrog's vice president of security research, told The Hacker news that one of the reasons for CVE-2026-1470's high CVSS score despite requiring authentication is that "any user of n8n can exploit this issue and gain a complete takeover of the entire n8n instance, so that makes it a bit more dangerous."
Successful exploitation of the flaws could permit an attacker to hijack an entire n8n instance, including under scenarios where it's operating under "internal" execution mode. In its documentation, n8n notes that using internal mode in production environments can pose a security risk, urging users to switch to external mode to ensure proper isolation between n8n and task runner processes.
"As n8n spans an entire organization to automate AI workflows, it holds the keys to core tools, functions, and data from infrastructure, including LLM APIs, sales data, and internal IAM systems, among others," JFrog said in a statement shared with The Hacker News. "This results in escapes giving a hacker an effective "skeleton key" to the entire corporation."
To address the flaws, users are advised to update to the following versions -
- CVE-2026-1470 - 1.123.17, 2.4.5, or 2.5.1
- CVE-2026-0863 - 1.123.14, 2.3.5, or 2.4.2
The development comes merely weeks after Cyera Research Labs detailed a maximum-severity security flaw in n8n (CVE-2026-21858 aka Ni8mare) that allows an unauthenticated remote attacker to gain complete control over susceptible instances. As of January 27, 2026, more than 39,000 n8n instances remain susceptible to the flaw, per data from the Shadowserver Foundation.
"These vulnerabilities highlight how difficult it is to safely sandbox dynamic, high‑level languages such as JavaScript and Python," researcher Nathan Nehorai said. "Even with multiple validation layers, deny lists, and AST‑based controls in place, subtle language features and runtime behaviors can be leveraged to bypass security assumptions."
"In this case, deprecated or rarely used constructs, combined with interpreter changes and exception handling behavior, were enough to break out of otherwise restrictive sandboxes and achieve remote code execution."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/01/two-high-severity-n8n-flaws-allow.html