n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
Summary: n8n patched a high-severity expression-sandbox escape, tracked as GHSA-gv7g-jm28-cr3m with a CVSS 4.0 score of 8.7, that lets an authenticated workflow editor run operating-system commands as the n8n process. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577, and n8n published fixed releases 2.31.5 and 2.32.1 on July 22, 2026.
Key Takeaway: Exploitation needs only a valid account with workflow-edit permission, and Security Joes says that access could expose N8N_ENCRYPTION_KEY and allow decryption of credentials stored in n8n, plus reach connected databases, internal services, and cloud endpoints. The advisory lists no patched 1.x release and does not say whether n8n Cloud was affected.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-27577
- Related