CVE-2026-27494: n8n Arbitrary File Read via Python Code Node Sandbox Escape
n8n versions before 1.123.22, from 2.0.0 up to but not including 2.9.3, and from 2.10.0 up to but not including 2.10.1 allow an authenticated user with permission to create or edit workflows to escape the sandbox of the Python Code node. The record describes file content exfiltration and RCE, with full host compromise possible on instances using internal Task Runners, and a NVD score of 9.9. The record lists fixes in 1.123.22, 2.9.3 and 2.10.1, and no confirmed exploitation appears in the sources consulted.
Overview
This CVE affects the n8n workflow automation platform. According to the record, an authenticated user who can create or modify workflows can use the Python Code node to escape its sandbox, because access to certain built-in Python objects is not sufficiently restricted. The GitHub security advisory is cited in the record as the vendor reference.
Impact
- The record states that an attacker could exfiltrate file contents from the host.
- The record states that the issue could lead to RCE.
- On instances using internal Task Runners (default runner mode), the record says this could result in full compromise of the n8n host.
- On instances using external Task Runners, the record says an attacker might access or affect other tasks run on the Task Runner.
Affected products and versions
- Versions before 1.123.22 are listed as affected.
- Versions from 2.0.0 up to but not including 2.9.3 are listed as affected.
- Versions from 2.10.0 up to but not including 2.10.1 are listed as affected.
- The record lists fixes in 1.123.22, 2.9.3 and 2.10.1, as shown in the 1.123.22 release, 2.9.3 release and 2.10.1 release references.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog, and the SSVC exploitation value is none. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00713 with a percentile of 0.53147, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Upgrade to 1.123.22, 2.9.3, 2.10.1 or a later fixed release, as the record advises.
- If an immediate upgrade is not possible, the record suggests limiting workflow creation and editing to fully trusted users, and/or disabling the Code node through the NODES_EXCLUDE setting.
- The record states that these workarounds do not fully remediate the risk and should only be short-term measures.
Detection guidance
- Review which accounts can create or edit workflows, and audit recent changes to workflows that use the Python Code node.
- Confirm whether Task Runners are enabled and whether the deployment uses internal or external runners.
- Compare the installed n8n version with the affected ranges listed above.
Limitations of the available information
- The record does not describe the sandbox bypass technically, and this analysis does not add such detail.
- The NVD score is 9.9 and the GitHub CNA score is 7.1, based on different CVSS methodologies; the record does not explain the difference.
- The record gives a CWE identifier but no CWE name.
- The EPSS date in the record is 2026-10-23, which is later than the published date; it is reported as given.
- The full text of the vendor advisory was not included in the record.
Frequently asked questions
Who can exploit this n8n vulnerability according to the record?
The record describes an authenticated user with permission to create or modify workflows. It does not describe an unauthenticated attack path.
Which n8n versions are listed as fixed?
The record lists fixes in 1.123.22, 2.9.3 and 2.10.1. Users should upgrade to one of these or a later fixed release.
Is this vulnerability known to be actively exploited?
The record shows it is not listed in CISA KEV and the SSVC exploitation value is none. No confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.