PT-2026-22029 · N8N · N8N

Marcopolopie + 1 · Published 2026-02-25 · Updated 2026-03-05 · CVE-2026-27494

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22

Description An authenticated user with permission to create or modify workflows could exploit the Python Code node to escape the sandbox. The sandbox did not sufficiently restrict access to certain built-in Python objects, potentially allowing an attacker to exfiltrate file contents or achieve Remote Code Execution (RCE). On instances using internal Task Runners (default runner mode), this could lead to a full compromise of the n8n host. On instances using external Task Runners, an attacker might gain access to or impact other tasks executed on the Task Runner. Task Runners must be enabled using the N8N RUNNERS ENABLED variable.

Recommendations Upgrade to n8n version 2.10.1 or later. Upgrade to n8n version 2.9.3 or later. Upgrade to n8n version 1.123.22 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, disable the Code node by adding n8n-nodes-base.code to the NODES EXCLUDE environment variable.

Exploit

Fix

RCE

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2026-27494

GHSA-MMGG-M5J7-F83H

Affected Products

N8N

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27494.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-mmgg-m5j7-f83h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmgg-m5j7-f83h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27494 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27494 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.9.3 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.22 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1 · Note
• https://twitter.com/CVEnew/status/2027004275142918420 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026827080843821391 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027006342775345188 · Twitter Post
• https://t.me/cveNotify/154350 · Telegram Post
• https://t.me/cveNotify/153266 · Telegram Post