Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution
Summary: JFrog Security Research disclosed two new flaws in the n8n workflow automation platform, including CVE-2026-1470, which carries a high CVSS score despite requiring authentication because any n8n user can exploit it to take over the entire instance. The flaws can let an attacker hijack a full n8n instance, including when it runs in "internal" execution mode, which n8n's own documentation says can pose a security risk in production.
Why it matters: JFrog describes n8n as holding the keys to LLM APIs, sales data, and internal IAM systems, so a successful escape amounts to a "skeleton key" to the whole corporation - and more than 39,000 n8n instances were still exposed to the earlier Ni8mare flaw as of January 27, 2026.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-1470CVE-2026-21858
- Related