CVE-2026-1470

criticalpriority · track · 7EPSS 0.204 · 97 %ileDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

20.4% (97th) EPSS

CVSS 9.9 · critical

Is it mine?

10 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.

cvss

Technical severity, 0–10. One row per scoring source.

9.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.9criticalAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · reefs@jfrog.comexploitability 3.1 · impact 6

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-95USCWE-95USCWE-95US

affected products (10)

Products and version ranges known to be affected.

n8n n8nall versionscert_bundDEcpe:/a:n8n:n8n:-
Сообщество свободного программного обеспечения N8n≤ 1.123.17fstec_bduRU
Сообщество свободного программного обеспечения N8n2.0.0 → 2.4.5fstec_bduRU
Сообщество свободного программного обеспечения N8n2.5.0 → 2.5.1fstec_bduRU
n8n n8n< 1.123.17nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
n8n n8n2.0.0 → 2.4.5nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
n8n n8n= 2.5.0nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
npm n8n< 1.123.17osvUSpkg:npm/n8n
npm n8n2.0.0 → 2.4.5osvUSpkg:npm/n8n
npm n8n2.5.0 → 2.5.1osvUSpkg:npm/n8n

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0227n8n: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des DienstesDeutsch2026-01-27csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in n8n ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
GHSA-5xrp-6693-jjx9n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution2026-01-27ghsa · osvUS
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv NVD CVE.org MITRE

published 2026-01-27modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan