Vulnerabilityhigh

Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution

The Hacker Newsby @TheHackersNewsJan 29, 2026 · 16:54 UTC (Jan 29, 2026)2 min read2 · 1 read

Read at thehackernews.com

Analyze CVE-2026-1470 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-1470 CVE-2026-0863 CVE-2026-21858

Tags: cve-2026-1470 cve-2026-0863 cve-2026-21858 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-0863	Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python…	9.9	9%	PoC ×2	Jan 18, 2026
CVE-2026-1470	Authenticated RCE via Workflow Expression Evaluation in n8n	9.9	20%	PoC	Jan 27, 2026
CVE-2026-21858	Unauthenticated RCE in n8n Workflow Automation (Ni8mare)	10.0	78%	PoC ×2	Jan 8, 2026

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Jan 28, 2026 Vulnerability / Workflow Automation Cybersecurity researchers have disclosed two new security flaws in the n8n workflow automation platform, including a crucial vulnerability that could result in remote code execution. The weaknesses, discovered by the JFrog Security Research team, are listed below -

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.