CVE-2026-1470 | n8n contains a critical Remote Code Execution (RCE) vulnerab… | CVSS 9.9 CRITICAL

Description

n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.

Metadata

CVE ID: CVE-2026-1470
State: PUBLISHED
Assigner: JFROG
Reserved: 2026-01-27 08:51 UTC
Published: 2026-01-27 14:23 UTC
Last updated: 2026-01-27 14:36 UTC
Primary CWE: CWE-95
CWE-95 Improper Neutralization of Directives in Dynamically …
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
—	—	—	0 < 1.123.17, 2.0.0 < 2.4.5, 2.5.0 < 2.5.1

Weakness (CWE)

CWE	Source	Description
CWE-95	cna	CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)