CVE-2026-27496 is a vulnerability classified under CWE-908 (Use of Uninitialized Resource) affecting the n8n workflow automation platform. The flaw exists in the JavaScript Task Runner component, where an authenticated user with permissions to create or modify workflows can cause the system to allocate uninitialized memory buffers. These buffers may contain leftover data from previous operations within the same Node.js process, including sensitive information such as secrets, tokens, or data from prior requests and tasks. This results in an information disclosure vulnerability. The vulnerability is exploitable without user interaction and does not require elevated privileges beyond workflow modification rights. The impact is primarily confidentiality loss, as attackers can read sensitive in-process data. The issue is mitigated by enabling external runner mode, which isolates the runner process and limits data exposure to that process only. The vulnerability affects n8n versions before 1.123.22, 2.9.3, and 2.10.1, with patches released in these versions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond workflow permissions, no user interaction, and high confidentiality impact. No known exploits are reported in the wild as of the publication date. Temporary mitigations include restricting workflow creation and editing permissions to fully trusted users and using external runner mode until upgrades can be applied.

The primary impact of CVE-2026-27496 is the unauthorized disclosure of sensitive information residing in memory buffers within the n8n Node.js process. This can include secrets, tokens, and data from previous workflow executions, potentially leading to credential theft, unauthorized access to integrated services, or leakage of confidential business data. Since the vulnerability requires authenticated access with workflow modification permissions, the risk is elevated in environments where multiple users have such privileges or where privilege escalation is possible. The confidentiality breach could facilitate further attacks such as lateral movement or privilege escalation within an organization’s automation infrastructure. However, the vulnerability does not affect data integrity or system availability. Organizations relying on n8n for critical automation workflows may face operational risks if sensitive tokens or credentials are exposed. The impact is mitigated if external runner mode is enabled, as it confines the exposure to the isolated runner process. Overall, the vulnerability poses a significant risk to confidentiality and trust in automated workflows, especially in multi-tenant or collaborative environments.

1. Upgrade n8n installations to versions 1.123.22, 2.9.3, 2.10.1, or later as soon as possible to apply the official patch addressing this vulnerability. 2. Restrict workflow creation and modification permissions strictly to fully trusted and vetted users to reduce the risk of exploitation by malicious insiders or compromised accounts. 3. Enable external runner mode by setting the environment variable `N8N_RUNNERS_MODE=external` to isolate the JavaScript Task Runner process, limiting the scope of data exposure if exploitation occurs. 4. Monitor and audit user activities related to workflow creation and modification to detect suspicious behavior indicative of exploitation attempts. 5. Implement strict access controls and network segmentation to limit access to the n8n platform and its runner processes. 6. Regularly review and rotate secrets and tokens used within workflows to minimize the impact of potential disclosure. 7. Educate administrators and users about the risks associated with granting workflow modification permissions and the importance of applying security updates promptly. These measures combined provide a layered defense that reduces the likelihood and impact of exploitation beyond generic patching advice.