Critical Zero-Click Flaw in n8n Allows Full Server Compromise
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-27493 +1 in the same advisory: …27577 | n8n is an open source workflow automation platform. n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When chained with an expression sandbox escape, this could escalate to remote code execution on the n8n host. The vulnerability requires a specific workflow configuration to be exploitable. First, a form node with a field interpolating a value provided by an unauthenticated user, e.g. a form submitted value. Second, the field value must begin with an `=` character, which caused n8n to treat it as an expression and triggered a double-evaluation of the field content. There is no practical reason for a workflow designer to prefix a field with `=` intentionally — the character is not rendered in the output, so the result would not match the designer's expectations. If added accidentally, it would be noticeable and very unlikely to persist. An unauthenticated attacker would need to either know about this specific circumstance on a target instance or discover a matching form by chance. Even when the preconditions are met, the expression injection alone is limited to data accessible within the n8n expression context. Escalation to remote code execution requires chaining with a separate sandbox escape vulnerability. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Review usage of form nodes manually for above mentioned preconditions, disable the Form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable, and/or disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures. NVD description · AI analysis pending | 9.5 group max | 1% |
| — |
Full article579 words · extracted from infosecurity-magazine.com · click to collapse
Researchers at Pillar Security have found two new critical vulnerabilities in self-hosted and cloud n8n deployments.
N8n is a popular open-source workflow automation platform powering hundreds of thousands of enterprise AI systems worldwide.
One of the flaws, tracked as CVE-2026-27493, can lead to full takeover of a server without the target clicking on anything and without the attacker needing to be authenticated.
Both vulnerabilities affect both n8n Cloud and self-hosted n8n instances.
Sandbox Escape Flaw: CVE-2026-27577 Explained
In December 2025, Pillar Security reported two maximum-severity (CVSS score of 10) sandbox escape vulnerabilities to n8n that could allow attackers to achieve complete server control and steal any stored credentials.
These findings prompted n8n to release an initial patch update in December followed by nine security fixes in early 2026. When applied, these security updates would fix the initial vulnerabilities found by Pillar Security.
However, the security researchers continued investigating n8n in February and found two additional flaws that were not addressed by the December-January security patches.
The first was initially reported by GitHub as CVE-2026-27577 on February 25.
This sandbox escape in the expression compiler is due to a missing case in the AST rewriter that lets the process slip through untransformed, allowing any authenticated attacker full remote code execution (RCE).
The Pillar Security researchers emphasized that, because n8n is a credential vault by function and stores keys to every system it connects to, a single sandbox escape exposes the n8n instance and every connected system.
“Post-exploitation is straightforward: the attacker reads the N8N_ENCRYPTION_KEY environment variable and uses it to decrypt every credential stored in n8n’s database: AWS keys, database passwords, OAuth tokens, API keys,” they wrote in a March 11 report.
CVE-2026-27577 has been assigned a critical severity rating of 9.4 (CVSS v4.0).
Read more: Maximum Severity “Ni8mare” Bug Lets Hackers Hijack n8n Servers
Zero-Click Unauthenticated Flaw: CVE-2026-27493 Explained
The second flaw was also reported by GitHub on February 25 and is tracked as CVE-2026-27493.
According to Pillar Security, CVE-2026-27493 takes it further than CVE-2026-27577.
This critical vulnerability (CVSS v4.0 rating of 9.5) is due to a double-evaluation bug in n8n’s Form nodes that turns any multi-step form that displays user input back into an expression injection point.
Since the form endpoints are public by design, an attacker doesn’t need any authentication, n8n account or workflow access to exploit it.
“A public ‘Contact Us’ form will run arbitrary shell commands if you type a payload into the Name field,” the Pillar Security researchers explained.
They also warned that for n8n Cloud and multi-tenant deployments, the impact extends beyond the individual instance.
“As demonstrated previously, sandbox escapes on n8n Cloud grant access to shared infrastructure, creating cross-tenant risk: a single public form on one tenant’s workflow could serve as the entry point. We assess the same cross-tenant risk applies based on the shared expression engine and infrastructure architecture confirmed during our earlier research,” the researchers added.
N8n Fixes and Mitigations
However, the Pillar Security specified that n8n Cloud should have already benefitted from automated fixes.
People self-hosting n8n instances are urged to update to versions 2.10.1, 2.9.3 or 1.123.22 of n8n, depending on their release channel.
Pillar Security also recommended users to rotate all stored credentials if a vulnerable workflow is found in their n8n environment.
“Any instance running an affected version could have exposed N8N_ENCRYPTION_KEY, which decrypts every credential stored in the platform,” the researchers said.
Read more: Critical and High Severity n8n Sandbox Flaws Allow RCE
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/critical-zeroclick-flaw-n8n-pillar/