CVE-2026-85165

criticalpriority · track · 40EPSS 0.006 · 47 %ileDEUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.57% (47th) EPSS

CVSS 9.9 · critical

Is it mine?

6 products

Check your exposure

Who says so?

2 sources

cert_bund · nvd

EPSS · scored 2026-10-27

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.

cvss

Technical severity, 0–10. One row per scoring source.

9.9

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.2–9.9

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.1 · impact 6

v4.07.2highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

v4.05.2mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-95USprimary

affected products (6)

Products and version ranges known to be affected.

n8n n8n <2.35.4all versionscert_bundDE
n8n n8n <2.36.2all versionscert_bundDE
n8n n8n< 2.35.4cert_bundDE
n8n n8n< 2.36.2cert_bundDE
n8n n8n< 2.35.4nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
n8n n8n2.36.0 → 2.36.2nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2936n8n: Mehrere SchwachstellenDeutsch2026-08-19csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in n8n ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery-Angriffe (SSRF) durchzuführen, Informationen offenzulegen und Daten zu manipulieren.

sources

Which sources assert this record, and when.

cert_bund nvd NVD CVE.org MITRE

published 2026-09-03modified 2026-09-03

related (340)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-33017US	critical9.8OT critical	96.2% (100th)	KEV	2026-03-20
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building…
CVE-2025-24893US	critical9.8OT critical	100.0% (100th)	KEV	2025-02-20
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to…
CVE-2024-36401US	critical9.8OT critical	99.8% (100th)	KEV	2024-07-01
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow…
CVE-2023-7101US	high7.8OT critical	19.0% (97th)	KEV	2023-12-24
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to…
CVE-2015-1497US	high10.0	74.5% (99th)	Exploit	2015-02-16
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465…

+335 more

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan