← Back to Vulnerability Reports CVE Intelligence

CVE-2026-27577

N8n•CRITICAL · CVSS 9.9•No exploitation reported

What is CVE-2026-27577?

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

CVSS9.9 NVD 3.1
SeverityCRITICAL
ExploitationNo exploitation reported
EPSS11% · P96
Triage statusNo Known Exploit
ActionPatch within 48 hours
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWECWE-94
NVD published2026-02-25
NVD last modified2026-07-28

Timeline

  • 2026-02-25Published to the U.S. National Vulnerability Database (NVD)
  • 2026-07-28First covered in a defend.network daily briefing
  • 2026-07-28NVD record last updated

Affected product

N8n

Remediation Steps

  1. Apply the vendor security update for N8n as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References

Referenced in our briefings & reports

Related vulnerabilities

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.