Vulnerability Overview

Disclosed in late May 2026, CVE-2026-27495 is a critical remote code execution (RCE) vulnerability affecting n8n, a popular workflow automation platform commonly used to link internal corporate databases, SaaS APIs, and DevOps pipelines.

With a CVSS score of 9.8, this vulnerability allows unauthenticated remote attackers to execute arbitrary system code on the server hosting the n8n application. Since n8n is typically deployed inside Kubernetes clusters with access to sensitive credentials, this exploit is frequently used as a launchpad for lateral movement throughout the enterprise network.

Technical Details

The flaw exists within the dynamic code compilation component used to execute custom JavaScript/TypeScript node parameters (Code nodes and expressions).

Due to a sandbox escape bug in the VM execution environment, unauthenticated attackers can construct a malicious payload that bypasses the execution boundaries of the node process. By injecting system calls through specific object prototypes, attackers can execute arbitrary commands on the parent operating system.

Attack Vector

Mitigation & Remediation

Organizations running n8n to automate their operations must secure their instances immediately.

1. Upgrade Immediately

Upgrade your n8n deployments to version v1.40.0 or higher, which patches the VM sandbox escape vulnerability and isolates JS/TS execution within secure sub-processes.

If using Docker Compose:

docker compose pull n8n
docker compose up -d

2. Isolate Kubernetes Pods (Mitigation)

If an upgrade is delayed, enforce network segregation on your n8n deployments inside Kubernetes:

• Apply NetworkPolicies to block the n8n pods from querying the Kubernetes API server (kube-apiserver) or cloud metadata endpoints (169.254.169.254).
• Disable automounting of the default service account token by setting automountServiceAccountToken: false in the pod spec.