CVE-2026-27494 — CRITICAL (CVSS 9.9) AI Security Vulnerability

CISO Take

CVE-2026-27494 is a critical sandbox escape in n8n's Python Code node that allows any authenticated user with workflow edit permissions to achieve RCE on the n8n host — a CVSS 9.9 is warranted. Patch immediately to 2.10.1 / 2.9.3 / 1.123.22; if you cannot patch today, restrict workflow editing to fully trusted users and disable the Code node via NODES_EXCLUDE. In AI/ML environments, n8n is commonly used as the orchestration backbone connecting LLMs, vector databases, and external APIs — a compromised n8n host exposes every secret and credential in that pipeline.

Risk Assessment

Exploitability is near-maximum: network-reachable, low complexity, only low privileges required, no user interaction. The default runner mode (internal Task Runners) results in full host compromise, making the blast radius exceptionally wide. Any organization running n8n as an AI agent orchestrator, RAG pipeline coordinator, or LLM tool router is at direct risk of losing control of all downstream AI infrastructure and credentials. The absence of CISA KEV listing does not reduce urgency given the trivial exploit conditions.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
186.5K OpenSSF 6.0 16 dependents Pushed 6d ago 40% patched ~3d to patch Full package profile →
n8n	npm	—	No patch
186.5K OpenSSF 6.0 16 dependents Pushed 6d ago 40% patched ~3d to patch Full package profile →

Severity & Risk

CVSS 3.1

9.9 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

Attack Surface

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

Recommended Action

6 steps

PATCH

Upgrade n8n to 2.10.1 (v2 branch), 2.9.3 (v2 LTS), or 1.123.22 (v1 LTS) immediately.
RESTRICT (if patching is delayed): Audit and revoke workflow creation/edit permissions for all non-essential users; apply least privilege.
DISABLE CODE NODE

Set NODES_EXCLUDE=n8n-nodes-base.code in your environment to eliminate the attack surface entirely until patched.
ROTATE CREDENTIALS

Assume any n8n instance exposed to non-admin authenticated users may have been compromised; rotate all API keys, tokens, and secrets stored in n8n environment variables or workflow configurations.
DETECT

Search logs for unusual outbound connections from the n8n process, unexpected file reads outside the n8n working directory, or execution of system-level commands (os.system, subprocess, __import__).
AUDIT

Review who has had workflow edit access in the past 90 days.

CISA SSVC Assessment

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Code Execution Agent RAG API AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0072 - Reverse Shell AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration AML.T0105 - Escape to Host

Compliance Impact

This CVE is relevant to:

EU AI Act

Art.15 - Accuracy, robustness and cybersecurity Article 15 - Accuracy, Robustness and Cybersecurity Article 9 - Risk Management System

ISO 42001

A.6.2.5 - AI system security A.6.2.6 - Information security in AI system development A.9.3 - AI system access control A.9.4 - Access control for AI systems

NIST AI RMF

GOVERN-1.7 - Processes for decommissioning and incident response MANAGE 2.2 - Mechanisms to sustain oversight of AI system operation MANAGE-2.4 - Residual risks are managed

OWASP LLM Top 10

LLM06:2025 - Excessive Agency LLM07 - Insecure Plugin Design LLM08 - Excessive Agency LLM09:2025 - Misinformation

Frequently Asked Questions

What is CVE-2026-27494?

CVE-2026-27494 is a critical sandbox escape in n8n's Python Code node that allows any authenticated user with workflow edit permissions to achieve RCE on the n8n host — a CVSS 9.9 is warranted. Patch immediately to 2.10.1 / 2.9.3 / 1.123.22; if you cannot patch today, restrict workflow editing to fully trusted users and disable the Code node via NODES_EXCLUDE. In AI/ML environments, n8n is commonly used as the orchestration backbone connecting LLMs, vector databases, and external APIs — a compromised n8n host exposes every secret and credential in that pipeline.

Is CVE-2026-27494 actively exploited?

No confirmed active exploitation of CVE-2026-27494 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27494?

1. PATCH: Upgrade n8n to 2.10.1 (v2 branch), 2.9.3 (v2 LTS), or 1.123.22 (v1 LTS) immediately. 2. RESTRICT (if patching is delayed): Audit and revoke workflow creation/edit permissions for all non-essential users; apply least privilege. 3. DISABLE CODE NODE: Set NODES_EXCLUDE=n8n-nodes-base.code in your environment to eliminate the attack surface entirely until patched. 4. ROTATE CREDENTIALS: Assume any n8n instance exposed to non-admin authenticated users may have been compromised; rotate all API keys, tokens, and secrets stored in n8n environment variables or workflow configurations. 5. DETECT: Search logs for unusual outbound connections from the n8n process, unexpected file reads outside the n8n working directory, or execution of system-level commands (os.system, subprocess, __import__). 6. AUDIT: Review who has had workflow edit access in the past 90 days.

What systems are affected by CVE-2026-27494?

This vulnerability affects the following AI/ML architecture patterns: workflow automation platforms, agent frameworks, AI pipeline orchestration, LLM tool/function calling backends, RAG pipelines, model serving infrastructure, AI agent orchestration layers.

What is the CVSS score for CVE-2026-27494?

CVE-2026-27494 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.09%.

Technical Details

NVD Description

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the Python Code node to escape the sandbox. The sandbox did not sufficiently restrict access to certain built-in Python objects, allowing an attacker to exfiltrate file contents or achieve RCE. On instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only., and/or disable the Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Exploitation Scenario

An attacker with a low-privilege n8n account (e.g., a contractor, compromised SaaS user, or insider) creates a new workflow containing a Python Code node. They craft Python leveraging unrestricted access to built-in objects — using introspection chains like `''.__class__.__mro__[1].__subclasses__()` to locate `subprocess.Popen` or `os.system` outside the sandbox boundary. On the default internal Task Runner configuration, this executes directly on the n8n host. The attacker reads `/proc/1/environ` and local `.env` files to harvest OpenAI API keys, vector database credentials, and cloud provider tokens. With RCE, they install a reverse shell, establish persistence via a cron job, and pivot to connected AI services — accessing the organization's RAG corpus, model fine-tuning datasets, and LLM inference infrastructure. The entire AI stack is now under adversary control.