Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
Summary: Pillar Security researchers disclosed two now-patched n8n flaws: CVE-2026-27577, a sandbox escape in the expression compiler where a missing case in the AST rewriter lets process slip through untransformed and gives any authenticated expression full remote code execution, and CVE-2026-27493, a double-evaluation bug in Form nodes exploitable through public form endpoints that require no authentication, such as entering a payload in a "Contact Us" form's Name field to run shell commands. n8n said the flaws affect self-hosted and cloud deployments, that chaining the two could escalate to remote code execution on the n8n host, and that versions 2.10.1, 2.9.3, and 1.123.22 also resolve two more critical vulnerabilities allowing arbitrary code execution, with no mention of exploitation in the wild.
What you should know: Pillar Security said an attacker could read the N8N_ENCRYPTION_KEY environment variable and use it to decrypt every credential in n8n's database, including AWS keys, database passwords, OAuth tokens, and API keys - and one of the entry points is a public form that requires no authentication or n8n account.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-27493CVE-2026-27577
- Related