CVE-2026-72764 n8n-io CVE debrief

Who should care

Defenders managing multi-user n8n instances with the JavaScript task runner and built-in or external modules enabled should assess exposure and prioritize patching to prevent potential cross-user isolation breaks.

Why it matters

CVE-2026-72764 is a medium-severity vulnerability in n8n's JavaScript task runner that allows a user to poison a cached module, affecting other users' Code-node executions. Defenders managing multi-user n8n instances should assess exposure and prioritize patching to prevent potential cross-user isolation breaks.

• Defenders need to verify exposure in their n8n instances.
• Cross-user isolation breaks could lead to unauthorized access or modifications.
• Patching vulnerable versions is crucial to prevent potential attacks.
• Further investigation is required to determine the full scope of affected systems.

Technical summary

The n8n JavaScript task runner shares a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user can poison a cached module, altering other users' Code-node executions on the same runner, impacting confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance, not a sandbox escape or remote code execution.

Defensive priority

Defenders should prioritize verifying exposure in multi-user n8n instances and applying patches to prevent potential cross-user isolation breaks.

Recommended defensive actions

• Verify if your n8n instance is running a vulnerable version and update to a patched version (1.123.67, 2.31.5, or 2.32.1) if necessary.
• Review and restrict user access to Code nodes in multi-user instances.
• Monitor for suspicious activity in n8n instance logs.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions (before 1.123.67, 2.31.5, and 2.32.1), and references to vendor advisories. The vulnerability allows a user able to run a Code node to poison a cached module and thereby alter other users' Code-node executions on the same runner. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected. The CVE record was published on 2026-08-11T13:19:06.530Z and has not been modified since then. The NVD entry is Anal

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.