PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27577 n8n-io CVE debrief

CVE-2026-27577 is a critical vulnerability in the n8n workflow automation platform that allows authenticated users to execute system commands on the host. The issue was patched in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. This vulnerability has a high impact on the confidentiality, integrity, and availability of the system. The vulnerability is caused by a weakness in the expression evaluation of n8n, which allows authenticated users to execute system commands.

Vendor
n8n-io
Product
n8n
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-25
Original CVE updated
2026-07-28
Advisory published
2026-02-25
Advisory updated
2026-07-28

Who should care

Administrators and users of the n8n workflow automation platform should be aware of this vulnerability and take steps to remediate it. This includes upgrading to a patched version of n8n and limiting workflow creation and editing permissions to fully trusted users only. Additionally, security teams and vulnerability management teams should review the vulnerability and assess the risk to their organization.

Technical summary

The vulnerability exists in the expression evaluation of n8n, which allows authenticated users with permission to create or modify workflows to abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. The vulnerability has a CVSS score of 9.4 and a severity of CRITICAL.

Defensive priority

High

Recommended defensive actions

  • Upgrade to n8n version 2.10.1, 2.9.3, or 1.123.22 or later
  • Limit workflow creation and editing permissions to fully trusted users only
  • Deploy n8n in a hardened environment with restricted operating system privileges and network access
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-02-25T23:16:21.387Z and was last modified on 2026-07-28T05:17:04.690Z. The NVD entry is currently Analyzed. The vulnerability exists in the expression evaluation of n8n, which allows authenticated users with permission to create or modify workflows to abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. Evidence limits suggest that defenders verify system command execution risks and review workflow parameters for potential abuse.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27577 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27577

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27577 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27577

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.