Information Disclosure Vulnerability in n8n Workflow Automation Platform
CVE-2026-27496
What is CVE-2026-27496?
n8n, a popular open-source workflow automation platform, has a vulnerability that allows authenticated users with workflow creation or modification permissions to exploit the JavaScript Task Runner. This can lead to the allocation of uninitialized memory buffers which may inadvertently reveal sensitive data, such as secrets and tokens, from the Node.js process. Versions before 1.123.22, 2.9.3, and 2.10.1 are vulnerable. To mitigate this risk, users are advised to upgrade immediately or limit workflow permissions and consider switching to external runner mode as short-term measures. However, these mitigations should not substitute for proper version upgrades.
Affected Version(s)
n8n < 1.123.22 < 1.123.22
n8n >= 2.0.0-rc.0, < 2.9.3 < 2.0.0-rc.0, 2.9.3
n8n >= 2.10.0, < 2.10.1 < 2.10.0, 2.10.1