CuraSec

tag: Workflow-Automation · 2 items

2026-07-27 · The Hacker News · source ↗ #sandbox-escape#rce#workflow-automation
  • Engineer — Act: Public PoC is on GitHub and this is a bypass of a prior February patch, indicating active research interest; if you self-host n8n, upgrade to 2.31.5 or 2.32.1 immediately to close authenticated RCE exposure.
  • SOC/IR — Plan: No KEV listing and EPSS is low (0.09), but the public PoC raises the practical risk; build a detection for unexpected child processes or OS command execution spawned by the n8n service account to cover in-estate exposure.
  • Leader — Skip
  • Signals: CVE-2026-27577 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub
  • Engineer — Plan: Any n8n Enterprise deployment trusting multiple external JWT issuers is exposed to cross-tenant account takeover via iss claim bypass; patch n8n to the fixed version and audit multi-issuer OIDC/JWT configurations now.
  • SOC/IR — Skip
  • Leader — Skip