CVE-2026-119408: n8n: RCE via deprecated nodes bypassing task runner

HIGH

Published October 30, 2026

CISO Take

CVE-2026-119408 lets any authenticated n8n user who can create, modify, or import workflows run arbitrary JavaScript in the n8n main process, because the deprecated Function, Function Item, and LangChain Code nodes execute outside task runner isolation. Although the CVSS is 8.8 (network, low complexity, low privileges), no public exploit, Nuclei template, or KEV listing exists and EPSS is not yet available, so the realistic risk is insider or compromised-account abuse. That risk is amplified because n8n main processes typically hold credentials for LLM providers, databases, and SaaS integrations across the whole instance, and the package has 277 other CVEs and a 69/100 risk score. Upgrade to n8n 2.42.6, 2.43.3, or 3.0.1 now, and until then restrict workflow create/import permissions and review existing workflows for these node types.

Sources:NVDGitHub AdvisoryATLASOpenSSFVulnCheck

What is the risk?

High. Exploitation is network-reachable, low complexity, needs only a low-privileged account with workflow edit/import rights and no user interaction. Impact is full confidentiality, integrity, and availability compromise of the n8n main process. Active exploitation is not observed (not in KEV, no public exploit or scanner template, EPSS N/A), which limits near-term likelihood, but the exploit logic is simple once the hidden node type names are known and the technical description and patch are public. Exposure is highest in multi-user or multi-tenant n8n instances, self-service automation platforms, and instances where workflow import from untrusted sources is allowed. Impact is greater because n8n commonly orchestrates AI agents and stores API keys for many systems.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privileged n8n account that can create or import workflows.

AML.T0012

Exploitation

A workflow naming a hidden deprecated Function, Function Item, or LangChain Code node runs JavaScript in the main process, outside task runner isolation.

AML.T0050

Credential Access

The code reads environment variables and the stored credentials for LLM providers, databases, and SaaS integrations.

AML.T0055

Impact

The attacker exfiltrates secrets, persists through malicious workflows, and pivots into connected AI and business systems.

AML.T0105

Initial Access

Attacker authenticates with a low-privileged n8n account that can create or import workflows.

AML.T0012

Exploitation

A workflow naming a hidden deprecated Function, Function Item, or LangChain Code node runs JavaScript in the main process, outside task runner isolation.

AML.T0050

Credential Access

The code reads environment variables and the stored credentials for LLM providers, databases, and SaaS integrations.

AML.T0055

Impact

The attacker exfiltrates secrets, persists through malicious workflows, and pivots into connected AI and business systems.

AML.T0105

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade to n8n 2.42.6, 2.43.3, or 3.0.1 or later (patch commit ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb). 2) Until patched, restrict workflow create, edit, and import rights to trusted administrators, and disable community or untrusted template imports. 3) Audit existing and imported workflows (including via the API and database) for Function, Function Item, and LangChain Code node types and remove or migrate them to the Code node running under task runners. 4) Enable and enforce task runners for code execution where supported, and consider disabling deprecated nodes via NODES_EXCLUDE. 5) Rotate credentials and API keys stored in n8n if suspicious workflow changes are found. 6) Detect: monitor audit logs for workflow creation or import by non-admin users, unexpected outbound connections from the n8n main process, and child processes spawned by n8n. 7) Do not expose n8n editor or API to the internet without strong authentication and network restrictions.

How is it classified?

Code ExecutionAuth BypassAgentFrameworkPluginAML.T0012- Valid Accounts AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to unknown or emergent risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-119408?

Is CVE-2026-119408 actively exploited?

No confirmed active exploitation of CVE-2026-119408 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-119408?

1) Upgrade to n8n 2.42.6, 2.43.3, or 3.0.1 or later (patch commit ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb). 2) Until patched, restrict workflow create, edit, and import rights to trusted administrators, and disable community or untrusted template imports. 3) Audit existing and imported workflows (including via the API and database) for Function, Function Item, and LangChain Code node types and remove or migrate them to the Code node running under task runners. 4) Enable and enforce task runners for code execution where supported, and consider disabling deprecated nodes via NODES_EXCLUDE. 5) Rotate credentials and API keys stored in n8n if suspicious workflow changes are found. 6) Detect: monitor audit logs for workflow creation or import by non-admin users, unexpected outbound connections from the n8n main process, and child processes spawned by n8n. 7) Do not expose n8n editor or API to the internet without strong authentication and network restrictions.

What systems are affected by CVE-2026-119408?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Workflow automation platforms, LLM orchestration pipelines, RAG pipelines.

What is the CVSS score for CVE-2026-119408?

CVE-2026-119408 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.63%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksWorkflow automation platformsLLM orchestration pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.

Exploitation Scenario

An attacker obtains low-privileged credentials to a shared n8n instance, for example through phishing or a leaked token, or is a malicious insider with workflow edit rights. They import a crafted workflow JSON naming a deprecated Function or LangChain Code node, which the UI hides but the backend still accepts. When the workflow executes, their JavaScript runs in the n8n main process outside task runner isolation. The code dumps environment variables and decrypts stored credentials for OpenAI, Anthropic, vector databases, and internal APIs, then exfiltrates them. The attacker then plants a persistent workflow that silently forwards data processed by AI agents, or uses the stolen keys to pivot into the connected systems.

Weaknesses (CWE)

CWE-653Improper Isolation or CompartmentalizationPrimary CWE-653Improper Isolation or Compartmentalization

CWE-653 — Improper Isolation or Compartmentalization: The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

[Architecture and Design] Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.

Source: MITRE CWE corpus.