CVE-2026-72764 n8n-io CVE debrief

Who should care

Defenders managing multi-user n8n instances with the JavaScript task runner enabled should assess exposure and prioritize verification of affected versions and remediation. This includes evaluating if the JavaScript task runner with built-in or external modules is enabled and considering updates to patched versions if affected. Security teams and operators managing n8n instances should review instance configurations and JavaScript task runner settings to确定

Why it matters

CVE-2026-72764 is a medium-severity vulnerability in n8n's JavaScript task runner that allows a user to poison a cached module, affecting other users' Code-node executions. Defenders managing multi-user instances should assess exposure, verify affected versions, and prioritize remediation.

• Verification of affected versions is required to determine exposure.
• Assessment of multi-user instance configurations and JavaScript task runner settings is necessary.
• Potential impacts to confidentiality, integrity, or availability require evaluation.
• Remediation priority is medium due to the limited scope of the vulnerability.

Technical summary

The n8n JavaScript task runner shares a single module cache across all users' Code-node executions. In affected versions, a user can poison the cache, altering other users' Code-node executions on the same runner, impacting confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance, not a sandbox escape or remote code execution. The vulnerability requires the JavaScript task runner with built-in or external modules to be enabled and affects multi-user instances. Defenders should prioritize verifying affected versions and assessing exposure in multi-user n8n instances with JavaScript task runner enabled.

Defensive priority

Defenders should prioritize verifying affected versions and assessing exposure in multi-user n8n instances with JavaScript task runner enabled.

Recommended defensive actions

• Verify if the instance is running an affected version (before 1.123.67, 2.31.5, or 2.32.1) and assess exposure.
• Evaluate if the JavaScript task runner with built-in or external modules is enabled.
• Consider updating to a patched version (1.123.67, 2.31.5, or 2.32.1) if affected.
• Monitor for potential module cache poisoning attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Affected versions include those before 1.123.67, 2.31.5, and 2.32.1. Defenders should verify if the instance is running an affected version and assess exposure. The JavaScript task runner with built-in or external modules must be enabled for exploitation to occur.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.