CVE-2026-65590: n8n Computer-Use Package RCE Vulnerability

CVE-2026-65590 Overview

CVE-2026-65590 is a shell sandbox bypass vulnerability in the @n8n/computer-use package used by n8n workflow automation. The package failed to enforce sandbox restrictions on Linux and Windows hosts, applying them only on macOS. Shell commands executed by the computer-use agent run without filesystem or network restrictions on affected platforms. This grants the agent process unrestricted access to the host filesystem and network. The flaw affects n8n versions before 2.29.8 and 2.30.x before 2.30.1. Only deployments that explicitly install and run the @n8n/computer-use package are affected. Standard n8n installations without this optional package are not exposed.

Critical Impact
Shell commands executed by the computer-use agent bypass sandboxing on Linux and Windows, giving the agent process unrestricted access to the host filesystem and network.

Affected Products

n8n versions before 2.29.8 with @n8n/computer-use installed
n8n 2.30.x before 2.30.1 with @n8n/computer-use installed
Linux and Windows deployments of @n8n/computer-use (macOS not affected)

Discovery Timeline

2026-07-22 - CVE-2026-65590 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65590

Vulnerability Analysis

The @n8n/computer-use package provides an agent that executes shell commands on the host system. The package was designed to constrain command execution using a shell sandbox that limits filesystem and network access. The sandbox logic was implemented only for macOS. On Linux and Windows, the sandbox enforcement was absent, so commands ran with the full privileges of the n8n process. This maps to [CWE-78] (OS Command Injection) because untrusted input controls shell command execution without adequate isolation. An operator or workflow author with sufficient privileges to configure the computer-use agent can direct it to read arbitrary files, modify data, or reach internal network services. The impact is confined to environments that explicitly opted into the @n8n/computer-use package. High privilege requirements limit unauthenticated exposure, but the missing sandbox breaks the security boundary the package documents.

Root Cause

The sandbox invocation was gated on operating system detection. Only the macOS branch wrapped shell execution with restriction primitives. Linux and Windows execution paths invoked the shell directly without applying filesystem or network policy.

Attack Vector

A user who can define or trigger a computer-use workflow supplies shell commands to the agent. On Linux or Windows, those commands execute in the n8n process context without restriction. The attacker reads host files, exfiltrates data over the network, or pivots to internal services reachable from the host.

No verified proof-of-concept code is published. See the GitHub Security Advisory and the VulnCheck Advisory for vendor detail.

Detection Methods for CVE-2026-65590

Indicators of Compromise

Unexpected child processes spawned by the n8n process on Linux (/bin/sh, bash) or Windows (cmd.exe, powershell.exe).
Outbound network connections from the n8n process to destinations not associated with configured workflows.
Read access to sensitive host paths such as /etc/shadow, SSH keys, or Windows credential stores by the n8n process.

Detection Strategies

Inventory n8n deployments and identify hosts where the @n8n/computer-use package is installed alongside n8n versions below 2.29.8 or 2.30.0.
Audit workflow definitions that invoke the computer-use agent for unexpected shell command payloads.
Correlate n8n process telemetry with filesystem and network access outside documented workflow scope.

Monitoring Recommendations

Log and alert on shell process creation whose parent is the n8n Node.js runtime.
Monitor egress from n8n hosts to non-approved destinations, including cloud metadata endpoints.
Track file integrity on directories reachable by the n8n service account.

How to Mitigate CVE-2026-65590

Immediate Actions Required

Upgrade n8n to 2.29.8 or 2.30.1 or later, which restore sandbox enforcement on Linux and Windows.
If upgrade is not immediately possible, uninstall or disable the @n8n/computer-use package on Linux and Windows hosts.
Restrict administrative access to n8n so only trusted operators can configure computer-use workflows.

Patch Information

n8n has released fixed versions 2.29.8 and 2.30.1 that apply shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package. Deployment details are documented in the GitHub Security Advisory GHSA-fpg6-x68q-5793.

Workarounds

Remove the @n8n/computer-use package from installations that do not require it.
Run n8n under a low-privilege service account with filesystem and network access constrained by OS-level controls such as AppArmor, SELinux, or Windows AppContainer.
Place n8n hosts on an isolated network segment with egress filtering to block unintended outbound connections.

bash

# Configuration example: remove the vulnerable optional package
npm uninstall @n8n/computer-use

# Or upgrade n8n to a fixed release
npm install n8n@2.30.1