n8n Sandbox Escape Bypasses February CVE-2026-27577 Patch

The n8n expression sandbox has failed a second time.

Security Joes found the flaw while auditing n8n’s February fix for CVE-2026-27577 — a CVSS 9.9 critical sandbox escape that let authenticated workflow editors execute operating-system commands on the server. The new vulnerability follows the same class: workflow editor access leads to OS command execution at the process level. The February patch is in the path; the bypass goes around it.

Affected versions

Two version tracks are exposed:

• Stable track: n8n < 2.31.5
• Current track: n8n >= 2.32.0, < 2.32.1

n8n fixed both tracks. The boundaries are 2.31.5 on the stable line and 2.32.1 on the current line. If you are on 2.31.x or 2.32.x and below those ceilings, you are running a vulnerable build.

Scope and risk

The attack requires workflow editor credentials — this is not an unauthenticated path. That boundary is meaningful in managed deployments with strict access controls and less meaningful in practice on self-hosted instances, which is most of n8n’s install base. The relevant risk surface is:

• Instances accessible from the internet with weak or shared credentials
• Deployments where workflow editor access is broadly granted to internal or contractor users
• n8n processes running under elevated or poorly scoped service accounts

The n8n process inherits the permissions of the account it runs under. A sandbox escape at this severity level is a vector, not the final destination — the damage radius after the shell depends entirely on what that service account can reach on the host and network. On default self-hosted setups, that’s often more than it should be.

What to do

Update to 2.31.5 or 2.32.1, whichever applies to your track. That’s the only complete fix.

One additional check that survives the patch: verify the n8n service account is scoped to least privilege. The sandbox escape is the entry point; the service account’s permissions determine how far an attacker can move after it. Correcting over-permissioned service accounts before you’re exploited is better than correcting them after — and it limits exposure if another sandbox escape surfaces.

The Security Joes technical write-up is linked from The Hacker News coverage for readers who want the bypass mechanics in detail. We covered a separate n8n authentication flaw — CVE-2026-59208, a JWT cross-issuer bypass — earlier this month. If you’re self-hosting n8n, that’s also worth reviewing; the two issues don’t overlap but the access-control posture that limits one also limits the other.