CVE-2026-1470: Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.
An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1470?
CVE-2026-1470 is classified as a critical vulnerability that allows remote code execution.
Who is affected by CVE-2026-1470?
CVE-2026-1470 affects authenticated users of n8n's workflow Expression evaluation system.
What is the impact of CVE-2026-1470?
CVE-2026-1470 allows authenticated users to bypass the Expression sandbox mechanism and execute arbitrary code.
How do I fix CVE-2026-1470?
To fix CVE-2026-1470, update n8n to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-1470 categorized as?
CVE-2026-1470 is categorized as a Remote Code Execution (RCE) vulnerability.