VulnerabilityPublished 25 Feb 2026

CVE-2026-27494: n8n · Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affects n8nSource CVE Database V5

Compare

Not known to be exploited · CVSS 7.1 High · fixed in 2.10.1 : patch n8n soon.

Data as of 29 Oct 2026, 19:04 UTC

CVSS 4.0 base score

7.1High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2.10.1, 2.9.3, 1.123.22

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: None
Vulnerable system confidentiality: High
Vulnerable system integrity: None
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: Low: The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: High: There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
Vulnerable system integrity: None: There is no loss of integrity within the Vulnerable System.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade n8n and n8n-io/n8n to 2.10.1, 2.9.3 or 1.123.22.

Affected software

Product	Affected	Fixed in
n8n-ion8n	Affected >=2.10.0 <2.10.1	Fixed in 2.10.1
n8n-ion8n	Affected >=2.0.0 <2.9.3	Fixed in 2.9.3
n8n-ion8n	Affected <1.123.22	Fixed in 1.123.22
GitHubn8n-io/n8n`pkg:github/n8n-io/n8n`Other threats	Affected <1.123.22 <2.9.3 <2.10.1	Fixed in 1.123.22 2.9.3 2.10.1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The primary mitigation is to upgrade n8n to versions 2.10.1, 2.9.3, or 1.123.22 or later, where the vulnerability is patched. Until upgrades can be performed, organizations should restrict workflow creation and modification permissions strictly to fully trusted administrators or users. Additionally, disabling the Python Code node by adding 'n8n-nodes-base.code' to the NODES_EXCLUDE environment variable can reduce risk but does not fully remediate the vulnerability. Monitoring and auditing workflow changes and user activities related to workflow creation can help detect potential exploitation attempts. For environments using external Task Runners, ensure strict isolation and access controls on the Task Runner hosts. Regularly review and harden authentication and authorization policies within n8n to minimize the number of users with elevated permissions. Finally, maintain network segmentation and host-level security controls to limit the impact of any potential compromise.

Description

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the Python Code node to escape the sandbox. The sandbox did not sufficiently restrict access to certain built-in Python objects, allowing an attacker to exfiltrate file contents or achieve RCE. On instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only., and/or disable the Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Impact

This vulnerability poses a critical risk to organizations using n8n for workflow automation, especially those with multiple users or exposed environments. Successful exploitation can lead to unauthorized disclosure of sensitive files, remote code execution, and potentially full system compromise on hosts running the internal Task Runner. This could result in data breaches, disruption of automated processes, lateral movement within networks, and loss of system integrity and availability. For environments using external Task Runners, attackers may disrupt or manipulate other tasks, potentially affecting business-critical workflows. The requirement for authenticated access with workflow modification permissions limits the attack surface but does not eliminate risk in multi-user or poorly controlled environments. Organizations relying on n8n in production, particularly those automating sensitive or critical operations, face significant operational and security impacts if this vulnerability is exploited.

Summary

The vulnerability identified as CVE-2026-27494 affects the n8n open source workflow automation platform in versions prior to 2.10.1, 2.9.3, and 1.123.22. The root cause lies in insufficient sandboxing of the Python Code node, which is designed to allow users to execute custom Python scripts within workflows. The sandbox failed to adequately restrict access to certain built-in Python objects, enabling an authenticated user with workflow creation or modification permissions to escape the sandbox environment. This escape allows attackers to read arbitrary files on the host system or execute arbitrary code remotely. The impact varies depending on the Task Runner configuration: with the default internal Task Runner, attackers can achieve full compromise of the host running n8n, while with external Task Runners enabled (via N8N_RUNNERS_ENABLED=true), attackers might access or interfere with other tasks running on the Task Runner. Exploitation requires authentication and specific permissions but no additional user interaction. The vulnerability is tracked under CWE-497, which relates to exposure of sensitive system information to unauthorized control spheres. The issue has been patched in the specified versions, and users are strongly advised to upgrade. Temporary mitigations include limiting workflow creation and editing permissions to trusted users and disabling the Code node by excluding it via environment variables, though these do not fully eliminate the risk.

CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
Architecture and Design · Implementation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V14.3.2 (opens in a new tab)
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
Attack patterns
Web Application Fingerprinting (opens in a new tab)
System Location Discovery (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Mar 2026, 09:59 UTC

WeaknessesCWE-497

Technical details

References

Community reviews

Related threats