Cybersecurity researchers disclosed details about two now-patched security vulnerabilities in the n8n workflow automation platform, including two critical bugs that could lead to arbitrary command execution.
See also: OAuth vulnerability in n8n platform leads to system breach
- CVE-2026-27577 (CVSS score: 9.4) – Expression sandbox escape leading to remote code execution (RCE)
- CVE-2026-27493 (CVSS score: 9.5) – Unauthenticated expression evaluation via n8η Form nodes
CVE-2026-27577 is a sandbox escape in the expression compiler: a case-missing bug in the AST rewriter allows procedures to escape without transformation, giving any authenticated expression a full RCE, according to Pillar Security researcher Eilon Cohen , who discovered and reported the issues.
CVE-2026-27493 is described as a “double evaluation bug” in n8n Form nodes that could be abused for expression injection, taking advantage of the fact that form endpoints are public by design and require neither authentication nor an n8n account. Successful exploitation can occur by using a public “Contact Us” form to execute arbitrary shell commands by providing a payload as input in the Name.
In an advisory announcement released at the end of last month, η8n stated that CVE-2026-27577 could be used by an authenticated user with permission to create or modify workflow streams to cause unintended system command execution on the host computer running η8n via crafted expressions in the workflow parameters.
The η8n also noted that CVE-2026-27493, when combined with an escape from the expression sandbox such as CVE-2026-27577, could be escalated to remote code execution on the η8n host computer. Both vulnerabilities affect the self-hosted and cloud deployments of n8n.
If the immediate remediation of CVE-2026-27577 is not an option, users are advised to limit the creation and editing of workflows to fully trusted users and to deploy n8n in an environment with restricted operating system privileges and network access.
See also: Six new vulnerabilities discovered in the n8n automation platform
For CVE-2026-27493, n8n recommends the following mitigations:
- Review of the use of form nodes manually for the aforementioned prerequisites.
- Disabling the Form node by adding η8n-nodes-base.form to the environment variable NODES_EXCLUDE.
- Disabling the Form Trigger node by adding n8η-nodes-base.formTrigger to the environment variable NODES_EXCLUDE.
These workarounds do not fully mitigate the risk and should only be used as short‑term mitigation measures, the maintainers warned.
Pillar Security said an attacker could exploit these vulnerabilities to read the N8N_ENCRYPTION_KEY and use it to decrypt any credentials stored in the n8n database, including AWS keys, database passwords, OAuth tokens, and API keys.
Beyond restricting the creation and editing of workflows to trusted users, n8n has outlined the following workarounds for each vulnerability:
- CVE-2026-27495 – Use of external execution mode (N8N_RUNNERS_MODE=external) to limit the blast radius.
- CVE-2026-27497 – Disabling the Merge node by adding n8n-nodes-base.merge to the environment variable NODES_EXCLUDE.
See also: Critical n8n vulnerability allows execution of system commands
While n8n does not report any of these vulnerabilities being exploited in the wild, users are advised to keep their installations up to date for optimal protection.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
