CVE-2026-27496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27496", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-19T19:46:03.542Z", "datePublished": "2026-03-25T17:07:06.221Z", "dateUpdated": "2026-03-25T20:09:07.795Z"}, "containers": {"cna": {"title": "n8n has In-Process Memory Disclosure in its Task Runner", "problemTypes": [{"descriptions": [{"cweId": "CWE-908", "lang": "en", "description": "CWE-908: Use of Uninitialized Resource", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-xvh5-5qg4-x9qp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-xvh5-5qg4-x9qp"}, {"name": "https://docs.n8n.io/hosting/configuration/task-runners", "tags": ["x_refsource_MISC"], "url": "https://docs.n8n.io/hosting/configuration/task-runners"}, {"name": "https://docs.n8n.io/hosting/securing/blocking-nodes", "tags": ["x_refsource_MISC"], "url": "https://docs.n8n.io/hosting/securing/blocking-nodes"}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"version": "< 1.123.22", "status": "affected"}, {"version": ">= 2.0.0-rc.0, < 2.9.3", "status": "affected"}, {"version": ">= 2.10.0, < 2.10.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T17:07:06.221Z"}, "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js process \u2014 including data from prior requests, tasks, secrets, or tokens \u2014 resulting in information disclosure of sensitive in-process data. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. In external runner mode, the impact is limited to data within the external runner process. The issue has been fixed in n8n versions 1.123.22, 2.10.1 , and 2.9.3. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or use external runner mode (`N8N_RUNNERS_MODE=external`) to isolate the runner process. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}], "source": {"advisory": "GHSA-xvh5-5qg4-x9qp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T20:08:59.028943Z", "id": "CVE-2026-27496", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T20:09:07.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27496", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T20:08:59.028943Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T20:09:03.708Z"}}], "cna": {"title": "n8n has In-Process Memory Disclosure in its Task Runner", "source": {"advisory": "GHSA-xvh5-5qg4-x9qp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "< 1.123.22"}, {"status": "affected", "version": ">= 2.0.0-rc.0, < 2.9.3"}, {"status": "affected", "version": ">= 2.10.0, < 2.10.1"}]}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-xvh5-5qg4-x9qp", "name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-xvh5-5qg4-x9qp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://docs.n8n.io/hosting/configuration/task-runners", "name": "https://docs.n8n.io/hosting/configuration/task-runners", "tags": ["x_refsource_MISC"]}, {"url": "https://docs.n8n.io/hosting/securing/blocking-nodes", "name": "https://docs.n8n.io/hosting/securing/blocking-nodes", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js process \u2014 including data from prior requests, tasks, secrets, or tokens \u2014 resulting in information disclosure of sensitive in-process data. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. In external runner mode, the impact is limited to data within the external runner process. The issue has been fixed in n8n versions 1.123.22, 2.10.1 , and 2.9.3. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or use external runner mode (`N8N_RUNNERS_MODE=external`) to isolate the runner process. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T17:07:06.221Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27496", "state": "PUBLISHED", "dateUpdated": "2026-03-25T20:09:07.795Z", "dateReserved": "2026-02-19T19:46:03.542Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T17:07:06.221Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n8n", "vendor": "n8n-io", "versions": [{"status": "affected", "version": "< 1.123.22"}, {"status": "affected", "version": ">= 2.0.0-rc.0, < 2.9.3"}, {"status": "affected", "version": ">= 2.10.0, < 2.10.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "77E36F68-2FDD-4771-B2DD-3F0A168E92E1", "versionEndExcluding": "1.123.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "CDB18D4D-1D4C-422A-BE3E-0FF8FC9DDD82", "versionEndExcluding": "2.9.3", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:2.10.0:*:*:*:*:node.js:*:*", "matchCriteriaId": "15F3A19A-0606-402C-ABD1-1B8E5BFCA130", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js process \u2014 including data from prior requests, tasks, secrets, or tokens \u2014 resulting in information disclosure of sensitive in-process data. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. In external runner mode, the impact is limited to data within the external runner process. The issue has been fixed in n8n versions 1.123.22, 2.10.1 , and 2.9.3. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or use external runner mode (`N8N_RUNNERS_MODE=external`) to isolate the runner process. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. Antes de las versiones 1.123.22, 2.9.3 y 2.10.1, un usuario autenticado con permiso para crear o modificar flujos de trabajo pod\u00eda usar el JavaScript Task Runner para asignar b\u00faferes de memoria no inicializados. Los b\u00faferes no inicializados pueden contener datos residuales del mismo proceso de Node.js \u2014 incluyendo datos de solicitudes anteriores, tareas, secretos o tokens \u2014 lo que resulta en la revelaci\u00f3n de informaci\u00f3n sensible de datos en proceso. Los Task Runners deben habilitarse usando 'N8N_RUNNERS_ENABLED=true'. En modo de ejecutor externo, el impacto se limita a los datos dentro del proceso del ejecutor externo. El problema se ha solucionado en las versiones de n8n 1.123.22, 2.10.1 y 2.9.3. Los usuarios deben actualizar a esta versi\u00f3n o posterior para remediar la vulnerabilidad. Si la actualizaci\u00f3n no es posible de inmediato, los administradores deben considerar las siguientes mitigaciones temporales: Limitar los permisos de creaci\u00f3n y edici\u00f3n de flujos de trabajo solo a usuarios de plena confianza, y/o usar el modo de ejecutor externo ('N8N_RUNNERS_MODE=external') para aislar el proceso del ejecutor. Estas soluciones alternativas no remedian completamente el riesgo y solo deben usarse como medidas de mitigaci\u00f3n a corto plazo."}], "id": "CVE-2026-27496", "lastModified": "2026-06-17T10:27:15.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27496", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T20:08:59.028943Z", "version": "2.0.3"}}]}, "published": "2026-03-25T18:16:31.310", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://docs.n8n.io/hosting/configuration/task-runners"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://docs.n8n.io/hosting/securing/blocking-nodes"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-xvh5-5qg4-x9qp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.123.22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0-rc.0,2.9.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,2.10.1)"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "n8n", "source": "cna", "vendor": "n8n-io"}, "product": "n8n", "vendor": "n8n"}], "analysis": {"en": {"generated_at": "2026-03-27T21:54:19.268133+00:00", "value": {"mitigation_remediation": ["Upgrade to n8n version 1.123.22, 2.9.3, or 2.10.1 or later to eliminate the flaw. ", "If upgrade is not immediately possible, restrict workflow creation and editing permissions to fully trusted users only. ", "Alternatively, enable external runner mode by setting N8N_RUNNERS_MODE=external to isolate the runner process and limit the scope of any data leakage."], "summary": {"action": "Immediate Patch", "impact": "In-Process Memory Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the n8n-io n8n automation platform. Versions prior to 1.123.22, 2.9.3, and 2.10.1 are susceptible. The issue was fixed in the corresponding patch releases, which should be applied to remove the risk.", "description_and_impact": "An authenticated user who can create or modify workflows can trigger the JavaScript Task Runner to allocate uninitialized memory buffers. These buffers may contain residual data from the same Node.js process, including secrets, tokens, or other sensitive information. The flaw is a source of information disclosure, classified by CWE-908.", "risk_and_exploitability": "The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication and the ability to create or edit workflows, and Task Runners must be enabled. Attackers could read residual memory data, potentially exposing confidential information."}}}}, "created": "2026-03-25T21:46:38.383647+00:00", "updated": "2026-03-29T20:28:18.117907+00:00", "vendors": ["n8n", "n8n$PRODUCT$n8n"]}