n8n hat Unauthentifizierte Expression Evaluation via Form Node

The impact of CVE-2026-27493 is severe due to its potential for remote code execution. An attacker can exploit this vulnerability by crafting malicious form data that includes an expression starting with an equals sign (=). This injected expression is then evaluated by n8n, allowing the attacker to execute arbitrary code on the server hosting the n8n instance. Successful exploitation could lead to complete system compromise, including data theft, modification, or destruction. The vulnerability's reliance on a specific workflow configuration (form node with user-provided input and interpolation) narrows the attack surface somewhat, but the potential for RCE remains a significant threat. The ability to chain this with an expression sandbox escape further amplifies the risk, enabling more direct code execution.

Organizations heavily reliant on n8n for workflow automation, particularly those with publicly accessible forms or integrations that accept user-provided input, are at significant risk. Environments with legacy n8n configurations or those lacking robust input validation practices are especially vulnerable. Shared hosting environments where multiple users share the same n8n instance also face increased risk due to the potential for cross-tenant exploitation.

• nodejs / server: Monitor n8n logs for unusual expression execution patterns or errors related to expression parsing. Use journalctl -u n8n to filter for relevant log entries. • nodejs / server: Check for unexpected processes running under the n8n user account using ps aux | grep n8n. • generic web: Inspect n8n access logs for suspicious requests containing = characters in form parameters, particularly those targeting form submission endpoints. Use curl -v <n8nformendpoint> to test for injection. • generic web: Review n8n configuration files for any insecure expression handling practices.

1. 2026-02-25Disclosure

   disclosure

1. Reserviert2026-02-19
2. Veröffentlicht2026-02-25
3. Geändert2026-02-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-27493 is to upgrade to n8n version 1.123.22 or later. This version includes a fix that prevents the expression injection vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Carefully review all workflow configurations, particularly those involving form nodes and user-provided input. Disable or modify workflows that utilize interpolation of user-supplied data, especially if the input is not properly validated. While a direct WAF rule is difficult to implement without deep inspection of n8n’s internal expression parsing, monitoring for unusual expression execution patterns in n8n logs can provide early warning signs of potential exploitation. There are no specific Sigma or YARA rules available at this time, but monitoring for unexpected process execution originating from the n8n process is recommended.