CVE-2026-65591: n8n expression sanitizer bypass leads

Q: Is CVE-2026-65591 actively exploited?

No confirmed active exploitation of CVE-2026-65591 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65591?

Upgrade immediately to n8n 1.123.64, 2.29.8, or 2.30.1, whichever tracks your current branch. Until patched, restrict workflow create/modify permissions to a minimal, trusted set of users and review existing workflows for unusual or obfuscated expressions referencing computed-member access patterns. Where possible, run n8n as a non-root, sandboxed/containerized process with restricted outbound network access to limit blast radius if the sandbox is bypassed. After patching, rotate any credentials (LLM API keys, database secrets, SaaS tokens) stored in or accessible from the n8n instance, and enable/review audit logging on workflow edits and executions to detect anomalous expression usage going forward.

Q: What systems are affected by CVE-2026-65591?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration platforms, AI agent orchestration pipelines.

Q: What is the CVSS score for CVE-2026-65591?

No CVSS score has been assigned yet.

CISO Take

n8n's legacy expression evaluator — the default engine in affected versions — has a sanitizer bypass in its computed-member handler that lets an authenticated user with only workflow create/modify permission escape the sandbox and execute arbitrary code on the host as the n8n process. There's no CVSS score, EPSS data, KEV listing, or public exploit/Nuclei template yet, so this hasn't been weaponized in the wild — but n8n is a widely deployed AI agent orchestration platform (16 tracked downstream dependents, 150 other CVEs already recorded against it, OpenSSF Scorecard a middling 6.6/10), and n8n instances typically hold LLM API keys, database and SaaS credentials wired into automation workflows, making a host compromise here high-value. The barrier to exploitation is a workflow-editing account, not network access — meaning insider threat, a phished low-privilege user, or a credential-stuffed n8n login all qualify as an initial access path. Patch to n8n 1.123.64, 2.29.8, or 2.30.1 immediately; until then, tightly restrict who holds workflow create/modify permissions and audit existing workflows for suspicious expression syntax.

Sources: GitHub Advisory VulnCheck OpenSSF ATLAS

What is the risk?

The requirement for an authenticated account with workflow create/modify permission meaningfully narrows the attacker population versus an unauthenticated RCE, but it does not neutralize the risk: n8n environments commonly grant workflow-edit rights to a broad set of internal automation builders, contractors, or low-trust integrators, any of whom can now pivot to full host compromise. Impact is severe (arbitrary host-level code execution as the n8n process) while current exploitation signals are quiet — no CISA KEV entry, no EPSS score, no public PoC or Nuclei template, and CVSS is unpublished. Absent an SSVC decision or exploit-maturity data, prioritization should be driven by exposure (who holds workflow permissions today) rather than by exploitation telemetry, which is currently uninformative for this CVE.

How does the attack unfold?

Initial Access

Attacker obtains or already holds an authenticated n8n account with workflow create or modify permission.

AML.T0012

Exploitation

Attacker crafts a malicious expression targeting the computed-member handler of the legacy expression evaluator, bypassing its sanitizer.

AML.T0050

Sandbox Escape

When the workflow executes, the crafted expression breaks out of the sandboxed evaluation context to the underlying host.

AML.T0105

Impact

Attacker achieves host-level code execution as the n8n process, enabling credential theft and lateral movement into connected AI/agent infrastructure.

AML.T0112.000

Initial Access

Attacker obtains or already holds an authenticated n8n account with workflow create or modify permission.

AML.T0012

Exploitation

Attacker crafts a malicious expression targeting the computed-member handler of the legacy expression evaluator, bypassing its sanitizer.

AML.T0050

Sandbox Escape

When the workflow executes, the crafted expression breaks out of the sandboxed evaluation context to the underlying host.

AML.T0105

Impact

Attacker achieves host-level code execution as the n8n process, enabling credential theft and lateral movement into connected AI/agent infrastructure.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.64	`1.123.64`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What should I do?

1 step

Upgrade immediately to n8n 1.123.64, 2.29.8, or 2.30.1, whichever tracks your current branch. Until patched, restrict workflow create/modify permissions to a minimal, trusted set of users and review existing workflows for unusual or obfuscated expressions referencing computed-member access patterns. Where possible, run n8n as a non-root, sandboxed/containerized process with restricted outbound network access to limit blast radius if the sandbox is bypassed. After patching, rotate any credentials (LLM API keys, database secrets, SaaS tokens) stored in or accessible from the n8n instance, and enable/review audit logging on workflow edits and executions to detect anomalous expression usage going forward.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0105 - Escape to Host AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.6.2 (approx.) - AI system technical documentation and change/vulnerability management

NIST AI RMF

MANAGE 4.1 - Risk monitoring and third-party AI component management

Frequently Asked Questions

What is CVE-2026-65591?

n8n's legacy expression evaluator — the default engine in affected versions — has a sanitizer bypass in its computed-member handler that lets an authenticated user with only workflow create/modify permission escape the sandbox and execute arbitrary code on the host as the n8n process. There's no CVSS score, EPSS data, KEV listing, or public exploit/Nuclei template yet, so this hasn't been weaponized in the wild — but n8n is a widely deployed AI agent orchestration platform (16 tracked downstream dependents, 150 other CVEs already recorded against it, OpenSSF Scorecard a middling 6.6/10), and n8n instances typically hold LLM API keys, database and SaaS credentials wired into automation workflows, making a host compromise here high-value. The barrier to exploitation is a workflow-editing account, not network access — meaning insider threat, a phished low-privilege user, or a credential-stuffed n8n login all qualify as an initial access path. Patch to n8n 1.123.64, 2.29.8, or 2.30.1 immediately; until then, tightly restrict who holds workflow create/modify permissions and audit existing workflows for suspicious expression syntax.

Is CVE-2026-65591 actively exploited?

No confirmed active exploitation of CVE-2026-65591 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65591?

Upgrade immediately to n8n 1.123.64, 2.29.8, or 2.30.1, whichever tracks your current branch. Until patched, restrict workflow create/modify permissions to a minimal, trusted set of users and review existing workflows for unusual or obfuscated expressions referencing computed-member access patterns. Where possible, run n8n as a non-root, sandboxed/containerized process with restricted outbound network access to limit blast radius if the sandbox is bypassed. After patching, rotate any credentials (LLM API keys, database secrets, SaaS tokens) stored in or accessible from the n8n instance, and enable/review audit logging on workflow edits and executions to detect anomalous expression usage going forward.

What systems are affected by CVE-2026-65591?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration platforms, AI agent orchestration pipelines.

What is the CVSS score for CVE-2026-65591?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation / orchestration platformsAI agent orchestration pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0105 Escape to Host

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2 (approx.)

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

Exploitation Scenario

An attacker gains access to an n8n account with workflow create or modify permission — via phishing, credential stuffing, an over-provisioned contractor account, or an already-compromised low-privilege SaaS identity. They create or edit a workflow node containing a crafted expression that targets the computed-member handler of the legacy expression evaluator, bypassing its sanitizer. When the workflow runs — triggered manually, via webhook, or on schedule — the expression escapes the sandbox and executes arbitrary OS commands as the n8n process user. From there the attacker harvests LLM API keys, database credentials, and other secrets wired into the automation platform, and uses host-level access to pivot into any AI services, vector databases, or internal systems the n8n instance can reach.

Weaknesses (CWE)

CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') Primary CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') Primary CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'): The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

[Architecture and Design] Avoid adding user-controlled data into an expression interpreter when possible.
[Implementation] If user-controlled data must be added to an expression interpreter, one or more of the following should be performed: Validate that the user input will not evaluate as an expression Encode the user input in a way that ensures it is not evaluated as an expression

Source: MITRE CWE corpus.