Full Report
Cybersecurity researchers have disclosed details of two now-patched security flaws in the n8n workflow automation platform, including two critical bugs that could result in arbitrary command execution. The vulnerabilities are listed below - CVE-2026-27577 (CVSS score: 9.4) - Expression sandbox escape leading to remote code execution (RCE) CVE-2026-27493 (CVSS score: 9.5) - Unauthenticated
Analysis Summary
# Vulnerability: Multiple Critical RCE Flaws in n8n Workflow Automation Platform
## CVE Details
- **CVE ID:** CVE-2026-27577
- **CVSS Score:** 9.4 (Critical)
- **CWE:** Sandbox Escape / Expression Injection
- **CVE ID:** CVE-2026-27493
- **CVSS Score:** 9.5 (Critical)
- **CWE:** Improper Input Validation (Double-Evaluation Bug)
*Note: The article also mentions CVE-2026-27495 and CVE-2026-27497 (both CVSS 9.4) regarding JavaScript Task Runner and Merge nodes.*
## Affected Systems
- **Products:** n8n workflow automation platform (Self-hosted and Cloud deployments).
- **Versions:**
- All versions starting from 2.0.0
- All versions starting from 2.10.0 prior to 2.10.1
- **Configurations:** Systems utilizing "Form" nodes, "Form Trigger" nodes, or "Merge" nodes are at elevated risk.
## Vulnerability Description
The flaws consist of a **sandbox escape** and an **unauthenticated injection** point:
- **CVE-2026-27577:** A flaw in the expression compiler's AST (Abstract Syntax Tree) rewriter. A missing case allows the `process` object to pass through untransformed, enabling authenticated users to escape the sandbox and achieve full Remote Code Execution (RCE).
- **CVE-2026-27493:** A "double-evaluation" bug in public-facing Form nodes. Because these endpoints are unauthenticated by design, an attacker can submit malicious payloads into form fields (e.g., the "Name" field) that the system evaluates as code.
**The Chain:** When combined, an unauthenticated attacker can use the Form node vulnerability to trigger the sandbox escape, resulting in zero-click unauthenticated RCE.
## Exploitation
- **Status:** PoC details disclosed by Pillar Security; no confirmed "in-the-wild" exploitation reported at time of publication.
- **Complexity:** Low (for CVE-2026-27493 via public forms).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** **High** – Attackers can read the `N8N_ENCRYPTION_KEY` to decrypt all stored credentials (AWS keys, API tokens, database passwords).
- **Integrity:** **High** – Arbitrary command execution allows full system compromise and data modification.
- **Availability:** **High** – Attackers can execute shell commands to disrupt services or delete data.
## Remediation
### Patches
Update n8n to one of the following fixed versions:
- **2.10.1**
- **2.9.3**
- **1.123.22**
### Workarounds
*If immediate patching is not possible:*
1. **Restrict Permissions:** Limit workflow creation/editing to highly trusted users only.
2. **Disable Nodes:** Add the following to the `NODES_EXCLUDE` environment variable:
- `n8n-nodes-base.form`
- `n8n-nodes-base.formTrigger`
- `n8n-nodes-base.merge` (to mitigate CVE-2026-27497)
3. **Environment Hardening:** Use external runner mode (`N8N_RUNNERS_MODE=external`) to isolate execution blast radius.
## Detection
- **Indicators of Compromise:** Unusual activity from the n8n host process; unexpected shell commands originating from the n8n execution context; entries in web logs showing suspicious javascript-style expressions in Form node POST requests.
- **Detection methods:** Review n8n logs for manipulated AST expressions or suspicious inputs in the "Name" fields of public forms.
## References
- **Vendor Advisory (CVE-2026-27577):** hxxps://github[.]com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr
- **Vendor Advisory (CVE-2026-27493):** hxxps://github[.]com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7
- **Researcher Report:** hxxps://www[.]pillar[.]security/blog/zero-click-unauthenticated-rce-in-n8n-a-contact-form-that-executes-shell-commands