CuraSec

Act archived

n8n Sandbox Escape Enables OS Command Execution via Workflow Editor

2026-07-27 13:44 UTC · The Hacker News · read the source ↗ #sandbox-escape#rce#workflow-automation
  • Engineer — Act: Public PoC is on GitHub and this is a bypass of a prior February patch, indicating active research interest; if you self-host n8n, upgrade to 2.31.5 or 2.32.1 immediately to close authenticated RCE exposure.
  • SOC/IR — Plan: No KEV listing and EPSS is low (0.09), but the public PoC raises the practical risk; build a detection for unexpected child processes or OS command execution spawned by the n8n service account to cover in-estate exposure.
  • Leader — Skip
  • Signals: CVE-2026-27577 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.