CVE-2026-65591 Overview
CVE-2026-65591 is a sanitizer bypass vulnerability in the workflow automation platform n8n. The flaw resides in the legacy expression evaluator's computed-member handler. An authenticated user with permissions to create or modify workflows can craft a malicious expression that circumvents the sanitizer. Successful exploitation results in host-level code execution as the n8n process. The legacy expression engine is the default in affected versions, which broadens the exposure. The issue is fixed in n8n 1.123.64, 2.29.8, and 2.30.1. The weakness is classified as [CWE-917], improper neutralization of special elements used in an expression language statement.
Critical Impact
Authenticated attackers can escape the expression sandbox and execute arbitrary code on the n8n host, compromising the automation platform and any secrets or integrations it manages.
Affected Products
- n8n versions prior to 1.123.64
- n8n versions prior to 2.29.8
- n8n versions prior to 2.30.1
Discovery Timeline
- 2026-07-22 - CVE-2026-65591 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-65591
Vulnerability Analysis
n8n evaluates user-supplied expressions inside workflow nodes to interpolate data between steps. The legacy expression engine wraps evaluation in a sanitizer intended to block access to dangerous JavaScript constructs such as constructor, prototype, and process. The computed-member handler processes bracket notation property access, for example obj[key]. The sanitizer's handling of computed-member expressions fails to normalize or reject values that resolve to blocked identifiers at runtime. An attacker constructs an expression where the property name is derived indirectly, sidestepping the string-based checks. Once the bypass succeeds, the evaluator reaches Node.js internals and yields code execution in the n8n process context.
Root Cause
The root cause is incomplete sanitization in the legacy expression evaluator. The computed-member handler inspects static property names but does not consistently evaluate dynamic expressions used as property keys. This gap allows the expression author to reach sensitive globals that the sanitizer intends to block. Because the legacy engine is enabled by default in affected releases, the vulnerable code path is reachable in typical deployments without configuration changes.
Attack Vector
The attack requires network access to the n8n interface or API and an account with workflow create or modify permissions. The attacker authors or edits a workflow containing a crafted expression, then triggers execution. Evaluation runs on the n8n server, so code executes with the privileges of the n8n process. Impact extends to stored credentials, connected SaaS integrations, and the underlying host operating system.
No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory and the VulnCheck Advisory on n8n for further technical detail.
Detection Methods for CVE-2026-65591
Indicators of Compromise
- Workflow definitions containing unusual computed-member expressions that reference identifiers such as constructor, process, require, or global through dynamic keys.
- Child processes spawned by the n8n runtime that are not associated with legitimate node executions or integrations.
- Outbound network connections from the n8n host to unexpected destinations shortly after workflow edits or executions.
Detection Strategies
- Inspect workflow JSON exports and database entries for expressions using bracket notation with concatenated or encoded property names.
- Enable and review n8n audit logs for workflow create and update events performed by non-administrative accounts.
- Alert on unexpected process lineage where the n8n Node.js process spawns shells, interpreters, or system utilities.
Monitoring Recommendations
- Forward n8n application logs and host process telemetry to a central analytics platform for correlation.
- Monitor for file writes to sensitive paths and credential stores originating from the n8n process.
- Track authentication events for accounts with workflow edit rights and flag anomalous session sources or times.
How to Mitigate CVE-2026-65591
Immediate Actions Required
- Upgrade n8n to 1.123.64, 2.29.8, or 2.30.1 depending on the release branch in use.
- Audit user accounts and revoke workflow create or modify permissions from users who do not require them.
- Rotate credentials, API keys, and OAuth tokens stored in n8n if untrusted users had edit access before patching.
Patch Information
The n8n maintainers addressed the sanitizer bypass in versions 1.123.64, 2.29.8, and 2.30.1. Deployment instructions and release notes are available in the GitHub Security Advisory GHSA-pm35-fqvh-cq5g. Upgrade the container image or package to a fixed version and restart the n8n service.
Workarounds
- Restrict workflow editing to a small set of trusted administrators until the upgrade is complete.
- Place the n8n instance behind an authenticated reverse proxy and block public network exposure.
- Run n8n as a low-privilege user inside an isolated container to limit the blast radius of code execution on the host.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
