n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22,
    additional exploits in the expression evaluation of n8n have been identified and patched following
    CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted
    expressions in workflow parameters to trigger unintended system command execution on the host running n8n.
    The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of
    these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible,
    administrators should consider the following temporary mitigations. Limit workflow creation and editing
    permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted
    operating system privileges and network access to reduce the impact of potential exploitation. These
    workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
    (CVE-2026-27577)

ID	Name	Product	Family	Type	Severity
438014	SCA: security update for n8n (GHSA-vpcf-gvg4-6qwr)	Tenable Cloud Security	SCA Checks	Local	critical
438014	SCA: security update for n8n (GHSA-vpcf-gvg4-6qwr)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-27577

critical

Tenable Plugins

critical

critical