CVE-2026-72764: n8n Privilege Escalation Vulnerability

CVE-2026-72764 Overview

CVE-2026-72764 is a cross-user isolation flaw in n8n's JavaScript task runner. The runner shared a single module cache across all users' Code-node executions on the same instance. A user able to execute a Code node could poison a cached module and alter other users' Code-node executions. The flaw affects confidentiality, integrity, and availability of co-tenant workflows on the same runner. It is not a sandbox escape and does not enable remote code execution outside the runner. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected. The issue maps to [CWE-668: Exposure of Resource to Wrong Sphere].

Critical Impact
A low-privileged user in a multi-tenant n8n deployment can poison shared Node.js module cache entries and manipulate the execution of other users' Code nodes on the same runner.

Affected Products

n8n JavaScript task runner versions prior to 1.123.67
n8n JavaScript task runner versions prior to 2.31.5
n8n JavaScript task runner versions prior to 2.32.1

Discovery Timeline

2026-08-11 - CVE-2026-72764 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72764

Vulnerability Analysis

n8n executes user-supplied JavaScript from Code nodes inside a dedicated task runner process. In vulnerable releases, that runner instantiated a single Node.js module cache that all tenants' Code-node executions shared. When one tenant required or imported a built-in or external module, the resolved module object was stored in the shared cache. Subsequent executions from any tenant received the same cached object.

An attacker with permission to run a Code node can mutate exports on a cached module. For example, replacing a function exported by a utility module with an attacker-controlled implementation changes behavior for every later execution that resolves that module. The impact scope covers data exposed to Code nodes, workflow outputs, and workflow availability if the poisoned module throws or hangs.

The vulnerability is a tenant-isolation break inside the runner process. It does not break out of the JavaScript sandbox and does not grant code execution on the host outside the runner's normal capabilities.

Root Cause

The root cause is a missing isolation boundary between users sharing the same task runner. The Node.js require cache and equivalent import cache were reused across executions instead of being scoped per user, per workflow, or per execution. This matches [CWE-668], where a resource intended for one execution context becomes reachable from another.

Attack Vector

Exploitation requires an authenticated user with rights to execute a Code node on a multi-user n8n instance that has the JS task runner and built-in or external modules enabled. The attacker runs a Code node that imports a target module and reassigns one of its exports. Any later Code-node execution on the same runner that imports the same module receives the tampered version. No network callback or additional privilege escalation is required. The vulnerability's exploitability is captured by an EPSS score of 0.374% (percentile 30.345).

No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-72764

Indicators of Compromise

Code-node executions that assign to properties of imported modules, for example require('some-module').fn = ... or Object.defineProperty on module exports.
Unexpected changes in Code-node output for workflows that were not modified by their owner.
Errors or timeouts in Code nodes across multiple users originating from the same task runner process.

Detection Strategies

Audit stored Code-node source across all workflows for patterns that mutate module exports or the require.cache object.
Correlate task runner process IDs with the users whose Code nodes executed on them to identify shared-runner exposure windows.
Compare Code-node execution outputs over time for workflows using shared utility modules to detect behavioral drift.

Monitoring Recommendations

Enable verbose logging on the n8n task runner and centralize logs for review of Code-node compile and execution events.
Alert on new or modified Code nodes that reference require.cache, module.exports reassignment, or prototype modification of built-in modules.
Track task runner restarts and version strings to confirm patched builds are in production.

How to Mitigate CVE-2026-72764

Immediate Actions Required

Upgrade the n8n JavaScript task runner to 1.123.67, 2.31.5, 2.32.1, or later on all multi-user instances.
Restrict who can create or edit Code nodes to trusted users until the upgrade is deployed.
Review recent Code-node changes on multi-user instances for module-cache tampering.

Patch Information

n8n released fixed versions 1.123.67, 2.31.5, and 2.32.1 that isolate the module cache across users. Refer to the GitHub Security Advisory GHSA-9cmh-xcqm-5hqr for release details and upgrade guidance.

Workarounds

Disable built-in and external modules in the JS task runner configuration if patching is not immediately possible.
Run separate task runner instances per tenant or per trust boundary to prevent shared module caches.
Limit Code-node execution permissions to a single trusted user group on affected instances.

bash

# Example: disable external modules in the n8n JS task runner via environment variables
export NODE_FUNCTION_ALLOW_BUILTIN=""
export NODE_FUNCTION_ALLOW_EXTERNAL=""
# Then restart the n8n service and task runner