Alex Joseph
Overview
The n8n automation platform is facing a critical security flaw. This flaw, identified as a sandbox escape vulnerability, allows a malicious authenticated user to execute unauthorized system commands on the host running n8n. It specifically impacts versions of n8n released before 2.31.5 and before 2.32.1. This is a severe issue because it could enable an attacker to gain complete control over the system hosting the n8n application.
CVE Details
- Product Name: n8n
- Published: August 11, 2026
- Severity: CRITICAL
- Status: Analyzed
Affected Products
This vulnerability primarily affects n8n instances running versions older than 2.31.5 and 2.32.1. Specifically, n8n version 2.32.0 is known to be vulnerable. Any deployment of these older versions is at significant risk of exploitation.
Current Status
This vulnerability has been thoroughly analyzed, and the details, including potential impacts and solutions, are available to the public. Patches have been released by the vendor, and users are strongly urged to update their n8n installations to the fixed versions without delay.
Severity Level
The vulnerability is rated as CRITICAL, with an assigned CVSS score of 9.9. This exceptionally high score underscores the profound risk associated with the flaw. An authenticated attacker, by leveraging this sandbox escape, can achieve remote code execution, leading to a complete compromise of the n8n host. This means vital system components, data confidentiality, integrity, and overall availability are all at severe risk.
Possible Solutions
The most effective and recommended solution to mitigate this critical vulnerability is to promptly update your n8n installation to a secure version.
- Upgrade Immediately: Users must upgrade their n8n application to version 2.31.5 or later, or version 2.32.1 or later. These specific updates include the necessary fixes to address the sandbox escape vulnerability.
- Temporary Mitigations (If Immediate Upgrade Is Not Possible): While an upgrade is the definitive solution, if you cannot update immediately, consider these temporary measures:
- Restrict User Access: Limit access to your n8n instance exclusively to fully trusted individuals within your organization.
- Control Permissions: Enforce strict permissions, allowing only fully trusted users the ability to create or modify workflows within n8n.
Please be aware that these workarounds are temporary and do not fully eliminate the risk. Prioritize a complete software upgrade for comprehensive protection.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-gv7g-jm28-cr3m
https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-expression-sandbox-escape
