n8n is a popular open-source platform that helps users automate various workflows. It’s designed to connect different applications and services, making tasks easier and more efficient. However, a recent security flaw has been discovered that could pose a significant risk to systems using older versions of the software.
This vulnerability, identified as CVE-2026-86076, is related to a weakness in n8n’s expression compiler sanitizer. In simpler terms, when n8n processes certain commands or “expressions” within a workflow, there’s a built-in security feature (the sanitizer) meant to prevent malicious code from running. Unfortunately, this feature could be bypassed. Attackers could craft specific inputs that trick the system into executing unauthorized code, potentially on the server where n8n is running or within the editor’s preview function. This could lead to serious security breaches, allowing unauthorized access or control over the affected system.
CVE Details
Product Name: n8n
Published: September 8, 2026
Severity: HIGH
Status: Analyzed
Affected Products
This vulnerability impacts versions of n8n prior to 1.123.76, 2.37.7, and 2.38.2. If you are running any version older than these, your system could be at risk.
Current Status
The vulnerability has been thoroughly analyzed by the n8n team. Patches have been released to address the issue, and affected users are strongly advised to update their installations as soon as possible.
Severity Level
The CVE-2026-86076 vulnerability has been assigned a HIGH severity rating, with a CVSS score of 8.8. A high severity indicates that the flaw could have a significant impact if exploited. In this case, it could lead to unauthorized backend code execution and JavaScript execution within the editor preview, potentially compromising the integrity and confidentiality of your data and systems.
Possible Solutions
The good news is that fixes are available. To protect your n8n instance from this vulnerability, you should update to one of the following patched versions immediately:
- n8n version 1.123.76
- n8n version 2.37.7
- n8n version 2.38.2
These updates contain the necessary security enhancements to prevent the sanitizer bypass and mitigate the risk of code execution. Always ensure your software is up-to-date to maintain a strong security posture.
References
https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-hw8v-xxg5-vvvx
