by Kastro
Paper/Archive/CVE-2026-1470

CVE-2026-1470

JFROG — Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.

EPSS 20%public exploitCVSS 9.9
critical.is priorityof 100
59
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 97.5.975 × 2019.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.

Affected

ProductAffectedFixed inSource
n8n< 1.123.171.123.17CNA
n8n2.0.0 – < 2.4.52.4.5CNA
n8n2.5.0 – < 2.5.12.5.1CNA

Scores by source

JFROG (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

patchgithub.com/n8n-io/n8n/commit/aa4d1e5825829182afa0ad5b81f602638f55fa04writeupresearch.jfrog.com/vulnerabilities/n8n-expression-node-rce