AI Threat AlertCVE-2026-126391: n8n: expression sandbox escape allows host code execution
HIGHn8n before 1.123.89 fails to properly isolate workflow expression evaluation, so any authenticated user who can create or edit workflows can escape the sandbox and run arbitrary code on the n8n host. This matters because n8n instances typically hold credentials for LLM APIs, databases, SaaS tools and internal systems, so host compromise exposes everything the automation platform can reach. Exploitation is not trivial: the CVSS vector rates attack complexity as high and requires low privileges. EPSS data is not yet available, there is no public exploit or Nuclei template, and the CVE is not in CISA KEV, so there is no sign of active exploitation today. Upgrade to 1.123.89 or later, restrict workflow edit rights to trusted users, and review stored credentials on any instance where untrusted or shared accounts could edit workflows.
What is the risk?
High (CVSS 7.5). The attack is network-reachable and needs only low privileges and no user interaction. Attack complexity is high, which limits mass exploitation. Impact on confidentiality, integrity and availability is rated high because code runs on the host. There is no KEV listing, no public exploit and no EPSS score, so near-term exploitation likelihood is unquantified. Risk is highest on multi-tenant or shared n8n instances, instances exposed to the internet, and deployments where many users hold workflow-edit permissions. Single-admin, internal-only instances carry lower risk.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 1.123.89 or later. 2) Until patched, restrict workflow create and edit permissions to trusted users and remove unused or shared accounts. 3) Do not expose the n8n editor to the internet; put it behind a VPN or SSO and network allow-lists. 4) Run n8n as a non-root user in a hardened container with minimal network egress and a read-only filesystem where possible. 5) Rotate credentials stored in n8n (API keys, database passwords, OAuth tokens) if untrusted users had edit access. 6) Detection: audit recent workflow creations and modifications, look for expressions that reference unusual JavaScript properties such as constructor or prototype chains, and watch for unexpected child processes, outbound connections or file writes from the n8n process. 7) Review the GitHub advisory GHSA-gx3v-3x3v-f8r5 and the VulnCheck advisory for details.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126391?
n8n before 1.123.89 fails to properly isolate workflow expression evaluation, so any authenticated user who can create or edit workflows can escape the sandbox and run arbitrary code on the n8n host. This matters because n8n instances typically hold credentials for LLM APIs, databases, SaaS tools and internal systems, so host compromise exposes everything the automation platform can reach. Exploitation is not trivial: the CVSS vector rates attack complexity as high and requires low privileges. EPSS data is not yet available, there is no public exploit or Nuclei template, and the CVE is not in CISA KEV, so there is no sign of active exploitation today. Upgrade to 1.123.89 or later, restrict workflow edit rights to trusted users, and review stored credentials on any instance where untrusted or shared accounts could edit workflows.
Is CVE-2026-126391 actively exploited?
No confirmed active exploitation of CVE-2026-126391 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126391?
1) Upgrade n8n to 1.123.89 or later. 2) Until patched, restrict workflow create and edit permissions to trusted users and remove unused or shared accounts. 3) Do not expose the n8n editor to the internet; put it behind a VPN or SSO and network allow-lists. 4) Run n8n as a non-root user in a hardened container with minimal network egress and a read-only filesystem where possible. 5) Rotate credentials stored in n8n (API keys, database passwords, OAuth tokens) if untrusted users had edit access. 6) Detection: audit recent workflow creations and modifications, look for expressions that reference unusual JavaScript properties such as constructor or prototype chains, and watch for unexpected child processes, outbound connections or file writes from the n8n process. 7) Review the GitHub advisory GHSA-gx3v-3x3v-f8r5 and the VulnCheck advisory for details.
What systems are affected by CVE-2026-126391?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, RAG pipelines.
What is the CVSS score for CVE-2026-126391?
CVE-2026-126391 has a CVSS v3.1 base score of 7.5 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0050Command and Scripting InterpreterAML.T0097Virtualization/Sandbox EvasionAML.T0112Machine CompromiseCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.
Exploitation Scenario
An attacker obtains a low-privilege n8n account, for example through credential stuffing, a compromised contractor account or an over-permissive self-service signup. They create or modify a workflow and add an expression that reaches unexpected JavaScript properties to break out of the expression sandbox. The expression runs arbitrary code on the n8n host. The attacker then dumps stored credentials such as LLM API keys, database and cloud tokens, exfiltrates data flowing through AI agent workflows, and installs a persistent reverse shell or a backdoored workflow to maintain access and move into connected systems.
Weaknesses (CWE)
CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- [Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
- [Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n