CVE-2026-0863: n8n Code Injection enables RCE

CISO Take

If your organization uses n8n for AI workflow automation or agent orchestration, treat this as an emergency patch. Any authenticated user with basic permissions can escape the Python sandbox via the Code block and execute arbitrary OS commands — in Internal mode, this means full n8n instance takeover and access to every credential stored in your workflows. Patch immediately, restrict Code block permissions to admins only as an interim control, and rotate all credentials connected to n8n.

What is the risk?

Critical. CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C reflects the worst-case profile: network-reachable, trivial to exploit, requires only a basic authenticated account, no user interaction, and scope change means downstream systems are also at risk. The attack barrier is minimal — any workflow user can trigger it. Internal execution mode deployments face full instance takeover; External (Docker sidecar) mode significantly reduces blast radius but arbitrary code execution inside the sidecar remains a serious incident.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
193.4K OpenSSF 6.6 Pushed 2d ago 55% patched ~7d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

8.5%

chance of exploitation in 30 days

Higher than 94% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

7 steps

PATCH

Apply commit b73a4283cb14e0f27ce19692326f362c7bf3da02 immediately.
WORKAROUND

Restrict Code block access to trusted administrators only until patched — audit and revoke Code block permissions for all standard users.
EXECUTION MODE

If running Internal mode, switch to External (Docker sidecar) mode to reduce blast radius while patching.
CREDENTIAL ROTATION

Audit all credentials stored in n8n (Settings → Credentials) and rotate any that may have been exposed, especially LLM API keys, database credentials, and OAuth tokens.
DETECTION

Monitor n8n process trees for unexpected child processes (shells, curl, wget), unusual outbound network connections from the n8n host, and new files created in the n8n data directory.
NETWORK SEGMENTATION

Restrict what the n8n host can reach on the network — it should not have unfettered access to internal infrastructure.
AUDIT

Review n8n access logs for unexpected Code block executions or unusual workflow activity.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Data Extraction Agent Framework Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0072 - Reverse Shell AML.T0083 - Credentials from AI Agent Configuration AML.T0097 - Virtualization/Sandbox Evasion AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.2.6 - Controls for AI systems A.9.3 - AI system operation and monitoring

NIST AI RMF

GOVERN-6.1 - Policies and procedures for AI risk in third-party components MANAGE-2.2 - Mechanisms to Sustain Oversight of AI Systems MANAGE-2.4 - Residual risks treated and managed MEASURE-2.5 - AI System Trustworthiness

OWASP LLM Top 10

LLM05 - Improper Output Handling LLM06 - Excessive Agency LLM07 - Insecure Plugin Design LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-0863?

If your organization uses n8n for AI workflow automation or agent orchestration, treat this as an emergency patch. Any authenticated user with basic permissions can escape the Python sandbox via the Code block and execute arbitrary OS commands — in Internal mode, this means full n8n instance takeover and access to every credential stored in your workflows. Patch immediately, restrict Code block permissions to admins only as an interim control, and rotate all credentials connected to n8n.

Is CVE-2026-0863 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-0863, increasing the risk of exploitation.

How to fix CVE-2026-0863?

1. PATCH: Apply commit b73a4283cb14e0f27ce19692326f362c7bf3da02 immediately. 2. WORKAROUND: Restrict Code block access to trusted administrators only until patched — audit and revoke Code block permissions for all standard users. 3. EXECUTION MODE: If running Internal mode, switch to External (Docker sidecar) mode to reduce blast radius while patching. 4. CREDENTIAL ROTATION: Audit all credentials stored in n8n (Settings → Credentials) and rotate any that may have been exposed, especially LLM API keys, database credentials, and OAuth tokens. 5. DETECTION: Monitor n8n process trees for unexpected child processes (shells, curl, wget), unusual outbound network connections from the n8n host, and new files created in the n8n data directory. 6. NETWORK SEGMENTATION: Restrict what the n8n host can reach on the network — it should not have unfettered access to internal infrastructure. 7. AUDIT: Review n8n access logs for unexpected Code block executions or unusual workflow activity.

What systems are affected by CVE-2026-0863?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI workflow automation, no-code/low-code AI pipelines, LLM orchestration platforms, multi-agent systems.

What is the CVSS score for CVE-2026-0863?

CVE-2026-0863 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 8.50%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI workflow automationno-code/low-code AI pipelinesLLM orchestration platformsmulti-agent systems

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0072 Reverse Shell

AML.T0083 Credentials from AI Agent Configuration

AML.T0097 Virtualization/Sandbox Evasion

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.2.6, A.9.3

NIST AI RMF: GOVERN-6.1, MANAGE-2.2, MANAGE-2.4, MEASURE-2.5

OWASP LLM Top 10: LLM05, LLM06, LLM07, LLM08

What are the technical details?

Original Advisory

Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact.

Exploitation Scenario

An adversary — either a compromised internal user or someone who obtained basic n8n credentials via phishing — logs into the n8n instance. They create or modify a workflow containing a Code block with Python execution enabled. Using Python's introspection capabilities (e.g., walking `__class__.__mro__` to access builtins, or exploiting string format specifiers and exception `__traceback__` chaining to escape restricted globals), they craft a payload that breaks out of the sandbox restrictions. Once outside the sandbox, they execute OS commands: first dumping `/proc/self/environ` and n8n's environment variables to harvest API keys and database credentials, then establishing a reverse shell for persistent access. On an Internal mode instance, they now own the host and can pivot to any system n8n was connected to — including production databases, cloud accounts, and LLM APIs. The entire AI automation backbone of the organization is compromised.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.