VYPR
Vypr IntelligenceAI-generatedSep 3, 2026· 9 CVEs

N8n Io: Nine Vulnerabilities Including RCE and Credential Exposure Disclosed Together

N8n Io: Nine vulnerabilities, including RCE and credential exposure, disclosed together on September 3, 2026, patched in recent versions.

Key findings

  • Nine vulnerabilities in N8n disclosed on September 3, 2026, patched in versions 1.123.73, 2.35.4, and 2.36.2.
  • High-severity flaws include RCE in the Git node (CVE-2026-85168) and sandbox escapes (CVE-2026-85169, CVE-2026-85165).
  • Credential exposure (CVE-2026-85171) and SSRF (CVE-2026-85172) vulnerabilities affect multiple nodes and functions.
  • Users are urged to update to patched versions to mitigate risks of data breaches and unauthorized access.
  • The batch includes vulnerabilities in API routes, workflow execution, and node integrations like Gmail and Elasticsearch.

On September 3, 2026, a batch of nine vulnerabilities was disclosed for N8n, an open-source workflow automation tool. These vulnerabilities, ranging in severity from Medium to High, were all patched in various versions of N8n, with the latest fixes arriving in versions 2.36.2, 2.35.4, and 1.123.73. The disclosures highlight several critical security weaknesses, including remote code execution, credential exposure, server-side request forgery, and sandbox escapes.

Several high-severity vulnerabilities were detailed in the disclosures:

  • Remote Code Execution (RCE): CVE-2026-85168, affecting N8n versions prior to 1.123.73, 2.35.4, and 2.36.2, stems from a flaw in the Git node. While the node reset certain configuration keys, it failed to cover the content-filter and merge-driver key families, allowing a compromised repository to execute arbitrary code.
  • Expression Sandbox Escapes and Bypasses: CVE-2026-85169 and CVE-2026-85165 represent significant security risks. CVE-2026-85169, present in versions before 1.123.73, 2.35.4, and 2.36.2, allowed an attacker to escape the expression sandbox via the $fromAI handler by exploiting how it resolved placeholder names and admitted reserved keys, leading to prototype pollution. Similarly, CVE-2026-85165, also in versions before 2.36.2, allowed authenticated users with workflow-edit permissions to mutate host objects through expression evaluation by exploiting how free identifiers in certain positions resolved against process globals.
  • Credential Exposure: CVE-2026-85171, impacting versions before 1.123.73, 2.35.4, and 2.36.2, involves the Strapi, SeaTable, and Mailcheck nodes. These nodes would send decrypted credentials to the authentication endpoint outside of error handling, leading to the plaintext secrets being persisted in execution logs.
  • Node-Specific Vulnerabilities: CVE-2026-85170, affecting versions before 1.123.73, 2.35.4, and 2.36.2, concerns the Gmail (v1) and Brevo nodes. These nodes passed message content to the mail composer without verifying it was a string. An authenticated user could supply an expression resolving to an object with path or href properties, causing the composer to read arbitrary files. CVE-2026-85166, also in versions before 1.123.73, 2.35.4, and 2.36.2, allows for the persistence of credential references in inline workflow JSON by users creating or updating workflows via the API.

Medium-severity issues were also addressed:

  • Missing Authorization: CVE-2026-85173, affecting N8n versions before 2.36.2, involves a missing per-project authorization in the Insights API routes. Authenticated users with insights scopes could access workflow names and execution statistics across projects by supplying arbitrary projectId parameters.
  • Server-Side Request Forgery (SSRF): CVE-2026-85172, present in versions before 2.34.1, contains an SSRF vulnerability in the legacy request helper function. Attackers could bypass validation by providing both uri and url properties, allowing for requests to unintended internal or external resources.
  • Query Injection: CVE-2026-85167, affecting N8n versions before 2.35.4 and 2.36.x before 2.36.2, lies within the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations. These operations interpolated expression values directly into query strings without proper validation, allowing for query injection when values contained quotes and braces.

The fixes for these vulnerabilities are available in N8n versions 1.123.73, 2.35.4, and 2.36.2. Users are strongly advised to update to the patched versions to mitigate these security risks. The coordinated disclosure of these nine CVEs underscores the importance of regular security updates for workflow automation platforms like N8n, which often handle sensitive data and integrations.

This batch of vulnerabilities highlights potential attack vectors including unauthorized data access, code execution, and credential theft, emphasizing the need for diligent patching and security auditing for N8n deployments.

The vulnerabilities were fixed in N8n versions 1.123.73, 2.35.4, and 2.36.2. N8n users should update to the latest patched versions immediately. The disclosures cover a range of critical security flaws including RCE, SSRF, and credential exposure. Multiple nodes and API routes were affected by these vulnerabilities. The $fromAI handler and Git node were specifically identified as vulnerable components. CVE-2026-85173, CVE-2026-85172, CVE-2026-85171, CVE-2026-85170, CVE-2026-85169, CVE-2026-85168, CVE-2026-85167, CVE-2026-85166, CVE-2026-85165

AI-written article. Grounded in 9 CVE records listed below.