n8n Sandbox Escape Enables OS Command Execution via Workflow Editor

Mon, 27 Jul 2026 13:44:31 +0000

Engineer — Act: Public PoC is on GitHub and this is a bypass of a prior February patch, indicating active research interest; if you self-host n8n, upgrade to 2.31.5 or 2.32.1 immediately to close authenticated RCE exposure.
SOC/IR — Plan: No KEV listing and EPSS is low (0.09), but the public PoC raises the practical risk; build a detection for unexpected child processes or OS command execution spawned by the n8n service account to cover in-estate exposure.
Leader — Skip
Signals: CVE-2026-27577 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub

n8n JWT Cross-Issuer Flaw Enables Account Takeover on Enterprise

Fri, 17 Jul 2026 12:06:10 +0000

Engineer — Plan: Any n8n Enterprise deployment trusting multiple external JWT issuers is exposed to cross-tenant account takeover via iss claim bypass; patch n8n to the fixed version and audit multi-issuer OIDC/JWT configurations now.
SOC/IR — Skip
Leader — Skip