Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary shell commands on the n8n host. The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 2 | Disclosure1PoC1 |
| 2026-02-26 | 7 | Disclosure5General1Patch1 |
| 2026-02-27 | 1 | Patch1 |
| 2026-03-11 | 1 | Patch1 |
I've discovered another vulnerability causing RCE in n8n, tracked as CVE-2026-27498. I'm dropping the link to the blog post in the replies. It's a quick read this time.
Post summary
A new RCE vulnerability (CVE-2026-27498) in n8n has been discovered, and the author plans to share a blog post with details.
https://fatihhcelik.github.io/posts/n8n-cve-2026-27498/
Post summary
The blog post discloses CVE-2026-27498 in n8n, provides PoC code and technical details, and references the vendor patch, but does not report active exploitation.
最近 n8n 爆出来了 4 个高危漏洞 CVE-2026-27495/CVE-2026-27497/CVE-2026-27498/CVE-2026-27577 一个 9.0，三个 9.4。 基本的影响都是允许执行远程命令。 这个事情倒是也不能说完全怪 n8n，大多数这种场景下的工具都会有类似的情况，各种 sandbox 逃逸，大家如果有自己部署的 n8n 记得升级到最新版
Post summary
The post announces four high‑severity CVEs affecting n8n (remote command execution) and urges users to upgrade to the latest version for remediation.
CVE-2026-27498 Authenticated Remote Code Execution in n8n Workflow Automation Platform https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27498
Post summary
A new authenticated remote code execution vulnerability (CVE-2026-27498) has been identified in the n8n Workflow Automation Platform.
Critical arbitrary command execution (CVE-2026-27498) impacts `n8n` via file write and Git operations. Update to 1.123.8 to mitigate risk. #n8n #RCE #InfoSec https://www.pulsepatch.io/posts/cve-2026-27498-n8n-arbitrary-command-execution
Post summary
CVE-2026-27498 allows arbitrary command execution in n8n through file write and Git operations; updating to version 1.123.8 mitigates the vulnerability.
『authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution.』 CVE-2026-27498 n8n has Arbitrary Command Execution via File Write and Git Operations https://github.com/advisories/GHSA-x2mw-7j39-93xq
Post summary
The advisory reveals that authenticated users in n8n can chain workflow nodes to perform arbitrary command execution via file write and git operations, enabling remote code execution.
🚨*CVE* CVE-2026-27498 n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could cha… https://www.cve.org/CVERecord?id=CVE-2026-27498 ----- Traducción: CVE-2026-27498 n8n… http://infoflow.cloud`
Post summary
The text announces CVE-2026-27498, a vulnerability in n8n that allows authenticated users to modify workflows before certain versions, as documented in the CVE record.
CVE-2026-27498 n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could cha… https://www.cve.org/CVERecord?id=CVE-2026-27498
Post summary
The CVE highlights a flaw in n8n where authenticated users with workflow creation/ modification rights can exploit a vulnerability in versions prior to 2.2.0 and 1.123.8.
Vulnerabilities like CVE-2026-27498 highlight the need for robust security measures in automation tools. Implementing proactive monitoring and patching processes can prevent 'GitPwned' scenarios. Automating security updates can save hours of manual intervention and safeguard your workflows. Curious about smart automation solutions? Check my profile for insights.
Post summary
The post references CVE-2026-27498 but only offers general security recommendations, lacking specific vulnerability details or exploitation evidence.
CVE-2026-27498: n8n Automation RCE: When 'GitOps' Becomes 'GitPwned' A critical Remote Code Execution (RCE) vulnerability exists in n8n, the popular workflow automation tool. By design, n8n allows users to automate file operations. However, a failure ... https://cvereports.com/reports/CVE-2026-27498
Post summary
The text announces a critical RCE vulnerability in n8n, detailing its nature but providing no PoC, exploit, or mitigation information.
🚨 CRITICAL code injection alert in n8n-io n8n! Auth users can exploit to gain shell access on vulnerable hosts. Patch to 2.2.0 / 1.123.8 ASAP. Restrict permissions & disable risky nodes! https://radar.offseq.com/threat/cve-2026-27498-cwe-94-improper-control-of-generati-673d3ea... https://t.co/g8ex3nZcmK
Post summary
A critical code injection vulnerability (CVE‑2026‑27498) in n8n‑io n8n allows authenticated users to gain shell access; patching to 2.2.0 / 1.123.8 is urgently recommended.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | n8n | n8n | - | node.js | - |