CVE-2026-56777: n8n - AST Validator Bypass in Python Code Node
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8NBLOCKRUNNERENVACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.25.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.26.2 - Configuration
In self-hosted n8n where Python Task Runner is enabled, ensure N8N_BLOCK_RUNNER_ENV_ACCESS is set to block access so environment variables accessible to the task runner process are not disclosed.
n8n (Python Task Runner / runner environment access) N8N_BLOCK_RUNNER_ENV_ACCESS = configured to disallow task runner env access (do not allow)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56777?
The severity of CVE-2026-56777 is medium with a score of 5.
How do I fix CVE-2026-56777?
To fix CVE-2026-56777, upgrade n8n to version 2.25.7 or later, or to 2.26.2 or later.
What does CVE-2026-56777 affect?
CVE-2026-56777 affects n8n versions before 2.25.7 and 2.26.x before 2.26.2.
Who is vulnerable to CVE-2026-56777?
Authenticated users with permission to create or modify workflows in n8n are vulnerable to CVE-2026-56777.
What type of vulnerability is CVE-2026-56777?
CVE-2026-56777 is a security validator bypass in the Python Code node.