CVE-2026-27498: RCE in n8n Workflow Automation

This vulnerability allows an authenticated attacker to gain complete control over the n8n server. By crafting malicious workflows that leverage the Read/Write Files from Disk node and subsequent git operations, an attacker can inject and execute arbitrary shell commands. The impact is significant, potentially leading to data breaches, system compromise, and complete takeover of the affected n8n instance. The ability to execute commands directly on the server bypasses typical security controls and represents a severe risk, especially in environments where n8n handles sensitive data or integrates with critical systems. Successful exploitation could allow an attacker to steal credentials, modify workflows, or even pivot to other systems on the network.

1. Reserved2026-02-19
2. Published2026-02-25
3. Modified2026-02-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade n8n to version 1.123.8 or 2.2.0 or later. If immediate upgrading is not feasible, administrators should restrict user permissions to minimize the potential attack surface. Specifically, limit users' ability to create or modify workflows, and carefully review existing workflows for suspicious activity. Consider implementing a Web Application Firewall (WAF) with rules to detect and block malicious workflow configurations attempting to execute shell commands. Regularly audit n8n configurations and user permissions to ensure adherence to security best practices.