CVE-2026-1470: n8n Remote Code Execution Vulnerability in Workflow Expression Evaluation
Summary
CVE-2026-1470: n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution. Affects n8n across 3 version ranges.
< 1.123.17
>= 2.0.0, < 2.4.5
>= 2.5.0, < 2.5.1
Fixed in 1.123.17, 2.4.5 or 2.5.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It provides a user-friendly interface for creating workflows using a variety of integrations. However, n8n has a critical vulnerability in its expression evaluation system, which can lead to remote code execution if exploited by an authenticated user.
Vulnerability Detail
The vulnerability arises from the insufficient isolation of the execution context during the evaluation of expressions supplied by authenticated users in workflow configurations. This flaw allows an attacker to execute arbitrary code with the privileges of the n8n process. The consequences of successful exploitation include unauthorized access to sensitive data, modification of workflows, and the ability to perform system-level operations, potentially leading to a full compromise of the affected instance.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.123.171.123.17npm install n8n@1.123.17 -
>= 2.0.0, < 2.4.52.4.5npm install n8n@2.4.5 -
>= 2.5.0, < 2.5.12.5.1npm install n8n@2.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, limit access to the n8n application to trusted users only, and avoid allowing untrusted users to configure workflows until the package is updated.
Conclusion
The n8n Remote Code Execution vulnerability (CVE-2026-1470) poses a significant risk to users of the platform. It is crucial to update to the latest version to mitigate this risk and ensure the security of your workflows.
See every vulnerability recorded for n8n →
FAQ
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
Any instance of n8n that is running versions prior to 1.123.17 or between 2.0.0 and 2.4.5 is affected by this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update immediately, restrict access to the n8n application to trusted users only and avoid allowing untrusted users to configure workflows.
Successful exploitation may lead to unauthorized access to sensitive data, modification of workflows, and execution of system-level operations, resulting in a full compromise of the affected instance.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
