CVE-2026-27493
CVE-2026-27493
Weakness (CWE)
CVSS Vector
v4.0- Attack Vector
- Network
- Attack Complexity
- Low
- Attack Requirements
- Present
- Privileges Required
- None
- User Interaction
- None
- Confidentiality (Vulnerable)
- High
- Integrity (Vulnerable)
- High
- Availability (Vulnerable)
- High
- Confidentiality (Subsequent)
- High
- Integrity (Subsequent)
- High
- Availability (Subsequent)
- High
Description
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When chained with an expression sandbox escape, this could escalate to remote code execution on the n8n host. The vulnerability requires a specific workflow configuration to be exploitable. First, a form node with a field interpolating a value provided by an unauthenticated user, e.g. a form submitted value. Second, the field value must begin with an `=` character, which caused n8n to treat it as an expression and triggered a double-evaluation of the field content. There is no practical reason for a workflow designer to prefix a field with `=` intentionally — the character is not rendered in the output, so the result would not match the designer's expectations. If added accidentally, it would be noticeable and very unlikely to persist. An unauthenticated attacker would need to either know about this specific circumstance on a target instance or discover a matching form by chance. Even when the preconditions are met, the expression injection alone is limited to data accessible within the n8n expression context. Escalation to remote code execution requires chaining with a separate sandbox escape vulnerability. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Review usage of form nodes manually for above mentioned preconditions, disable the Form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable, and/or disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Comprehensive Technical Analysis of CVE-2026-27493
1. Vulnerability Assessment and Severity Evaluation
CVE ID: CVE-2026-27493
Description: n8n, an open-source workflow automation platform, is affected by a second-order expression injection vulnerability in its Form nodes. This vulnerability allows an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When combined with an expression sandbox escape, this can escalate to remote code execution (RCE) on the n8n host.
CVSS Score: 9
Severity Evaluation: The CVSS score of 9 indicates a critical vulnerability. The high score is justified by the potential for remote code execution, which can lead to complete system compromise. The vulnerability requires specific conditions to be met, but once exploited, it can have severe consequences.
2. Potential Attack Vectors and Exploitation Methods
Attack Vectors:
- Unauthenticated Access: An attacker can exploit this vulnerability without needing authentication, making it highly accessible.
- Crafted Form Data: The attacker submits specially crafted form data that includes an expression prefixed with an
=character. - Expression Injection: The crafted data triggers a double-evaluation of the field content, leading to expression injection.
- Sandbox Escape: To escalate to RCE, the attacker must chain the expression injection with a sandbox escape vulnerability.
Exploitation Methods:
- Discovery: The attacker needs to identify a form node with a field interpolating a value provided by an unauthenticated user.
- Injection: The attacker submits form data with an expression prefixed with
=, causing n8n to treat it as an expression. - Escalation: The attacker chains the expression injection with a sandbox escape to achieve RCE.
3. Affected Systems and Software Versions
Affected Versions:
- n8n versions prior to 2.10.1
- n8n versions prior to 2.9.3
- n8n versions prior to 1.123.22
Affected Systems: Any system running the affected versions of n8n with a workflow configuration that includes a form node interpolating unauthenticated user input.
4. Recommended Mitigation Strategies
Immediate Mitigation:
- Upgrade: Upgrade to n8n versions 2.10.1, 2.9.3, or 1.123.22 or later to remediate the vulnerability.
- Temporary Workarounds:
- Review usage of form nodes manually for the preconditions mentioned.
- Disable the Form node by adding
n8n-nodes-base.formto theNODES_EXCLUDEenvironment variable. - Disable the Form Trigger node by adding
n8n-nodes-base.formTriggerto theNODES_EXCLUDEenvironment variable.
Long-Term Mitigation:
- Regular Patching: Implement a regular patching and update schedule for all software components.
- Input Validation: Ensure robust input validation and sanitization for all user-provided data.
- Security Audits: Conduct regular security audits and code reviews to identify and mitigate potential vulnerabilities.
5. Impact on Cybersecurity Landscape
Immediate Impact:
- System Compromise: Organizations using affected versions of n8n are at risk of system compromise through RCE.
- Data Breach: Sensitive data could be accessed or exfiltrated by attackers exploiting this vulnerability.
Long-Term Impact:
- Reputation Damage: Organizations experiencing a breach due to this vulnerability may face reputational damage.
- Increased Awareness: This vulnerability highlights the importance of securing workflow automation platforms and the need for robust input validation.
6. Technical Details for Security Professionals
Vulnerability Details:
- Expression Injection: The vulnerability arises from the double-evaluation of field content when prefixed with
=. - Sandbox Escape: The expression injection alone is limited to the n8n expression context. Escalation to RCE requires a separate sandbox escape vulnerability.
Detection and Monitoring:
- Log Analysis: Monitor logs for unusual form submissions and expression evaluations.
- Anomaly Detection: Implement anomaly detection mechanisms to identify unexpected behavior in workflow executions.
- Intrusion Detection: Use intrusion detection systems (IDS) to detect and alert on potential exploitation attempts.
Incident Response:
- Containment: Immediately disable affected form nodes and isolate the n8n instance.
- Investigation: Conduct a thorough investigation to determine the extent of the compromise.
- Remediation: Apply the necessary patches and updates, and review all workflow configurations for potential vulnerabilities.
Conclusion: CVE-2026-27493 represents a critical vulnerability in n8n that can lead to remote code execution. Organizations using n8n should prioritize upgrading to the patched versions and implement robust security measures to mitigate the risk. Regular security audits and input validation are essential to prevent similar vulnerabilities in the future.