CVE-2026-27577 is a critical flaw (CVSS 9.9) in n8n, the open source workflow automation platform. A signed in user who can create or edit workflows can abuse crafted expressions to run system commands on the host. Upgrade to n8n 2.10.1, 2.9.3 or 1.123.22, or later.
What's affected
According to the record, n8n versions before 2.10.1, 2.9.3 and 1.123.22 are affected, depending on which line you run. The fixed releases are:
- 2.10.1 on the 2.10 line
- 2.9.3 on the 2.9 line
- 1.123.22 on the 1.x line
The record describes this as additional expression evaluation exploits found and patched after CVE-2025-68613, an earlier n8n remote code execution issue. If you patched that one and stopped, you are not done. The KEV flag is false, and the record does not say the bug is exploited in the wild.
How to check if you're exposed
Find your n8n version, wherever it runs.
# Installed with npm
n8n --version
npm ls -g n8n
# Running in Docker
docker exec <container> n8n --version
docker image ls n8nio/n8n
Then ask who can create or modify workflows. The risk depends heavily on that list. A single editor account with a weak password is enough to put the host in play, because the process runs with whatever operating system rights you gave n8n.
What to do now
- Upgrade to 2.10.1, 2.9.3 or 1.123.22, or any later release.
- If you cannot upgrade today, limit workflow creation and editing to fully trusted users only. This is the vendor's own interim advice.
- Run n8n in a hardened environment with restricted operating system privileges and limited network access, so a compromise has less to reach.
- Remember the vendor says these workarounds do not fully remove the risk. They buy time and nothing more.
- Rotate credentials stored in n8n if an untrusted person ever held editor rights.
- Review recent workflow changes for expressions you do not recognise.
Why it matters
The weakness is code injection, listed as CWE-94. n8n lets users write expressions inside workflow parameters, and those expressions are evaluated by the server. If the evaluation context is not sealed off from the underlying runtime, text that was meant to be a formula can reach the operating system. Fixes for this class tend to arrive in rounds, because every new route out of the sandbox has to be closed separately.
The scope is marked changed in the vector, which fits the shape of the product. An automation server usually holds API keys and tokens for many other systems. Code running on the n8n host can read all of them, so the damage is not limited to n8n itself.
The practical lesson is to treat workflow edit rights as code execution rights until you have patched, and to keep the automation host free of secrets it does not need.
Reading the fixed versions
The fix ships on three lines because n8n maintains more than one release train. If you are on 2.x, move to 2.10.1 or to 2.9.3 if you track the older minor. If you are still on 1.x, the target is 1.123.22. Skipping across lines is possible, but test your workflows first, since a major version change can alter node behaviour.
A short hardening list for automation hosts
Patching removes this bug and not the class of problem. A workflow engine will always run user defined logic, so plan for the next one.
- Give n8n its own service account with no shell login and no access to home directories of other users.
- Run it in a container with a read only root file system where possible, and mount only the data directory it needs.
- Block outbound network access except to the services your workflows call.
- Keep credentials in the n8n credential store and scope each API key to the least access it needs, so a stolen set opens as few doors as possible.
- Review who has editor rights every quarter, and remove people who changed roles.
None of this replaces the upgrade. It reduces what a successful attacker can reach while you roll out fixes, and the vendor itself suggests restricting editors and hardening the environment as short term measures.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to exploit this?
Yes. The record says an authenticated user with permission to create or modify workflows is required. That makes editor access control your first line of defence.
Sources
- n8n advisory GHSA-v98v-ff95-f3cp (related earlier expression issue)
- n8n hosting security overview (from the record)
Last reviewed: 19 October 2026.
