PT-2026-22036 · N8N · N8N

Aikido-Security + 2 · Published 2026-02-25 · Updated 2026-03-04 · CVE-2026-27578

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22

Description n8n is a workflow automation platform susceptible to arbitrary script injection. An authenticated user with permission to create or modify workflows could inject malicious scripts into pages rendered by the n8n application through various nodes, including the Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node. These injected scripts execute in the browser of any user visiting the affected page, potentially leading to session hijacking and account takeover.

Recommendations Upgrade to n8n version 2.10.1 or later. Upgrade to n8n version 2.9.3 or later. Upgrade to n8n version 1.123.22 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, disable the Webhook node by adding n8n-nodes-base.webhook to the NODES EXCLUDE environment variable.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-27578

GHSA-2P9H-RQJW-GM92

Affected Products

N8N

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27578.json · Exploit
• https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6 · Patch
• https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e · Patch
• https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534a · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2p9h-rqjw-gm92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27578 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/VulmonFeeds/status/2026811723592663396 · Twitter Post
• https://twitter.com/_cvereports/status/2026887528427438296 · Twitter Post
• https://twitter.com/CVEnew/status/2027004271246401935 · Twitter Post
• https://t.me/cveNotify/154062 · Telegram Post
• https://t.me/CVEtracker/45782 · Telegram Post
• https://twitter.com/infoflowcloud/status/2027006261238137221 · Twitter Post