CVE-2026-27498

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27498", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-19T19:46:03.542Z", "datePublished": "2026-02-25T22:42:21.618Z", "dateUpdated": "2026-02-26T20:21:05.587Z"}, "containers": {"cna": {"title": "n8n has Arbitrary Command Execution via File Write and Git Operations", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq"}, {"name": "https://github.com/n8n-io/n8n/commit/97365caf253978ba8e46d7bc53fa7ac3b6f67b32", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/97365caf253978ba8e46d7bc53fa7ac3b6f67b32"}, {"name": "https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866"}, {"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.8"}, {"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.2.0"}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"version": "< 1.123.8", "status": "affected"}, {"version": ">= 2.0.0, < 2.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T22:42:21.618Z"}, "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary shell commands on the n8n host. The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}], "source": {"advisory": "GHSA-x2mw-7j39-93xq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:20:10.387603Z", "id": "CVE-2026-27498", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:21:05.587Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T20:20:10.387603Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:20:16.276Z"}}], "cna": {"title": "n8n has Arbitrary Command Execution via File Write and Git Operations", "source": {"advisory": "GHSA-x2mw-7j39-93xq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "< 1.123.8"}, {"status": "affected", "version": ">= 2.0.0, < 2.2.0"}]}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq", "name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/n8n-io/n8n/commit/97365caf253978ba8e46d7bc53fa7ac3b6f67b32", "name": "https://github.com/n8n-io/n8n/commit/97365caf253978ba8e46d7bc53fa7ac3b6f67b32", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866", "name": "https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.8", "name": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.2.0", "name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary shell commands on the n8n host. The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T22:42:21.618Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27498", "state": "PUBLISHED", "dateUpdated": "2026-02-26T20:21:05.587Z", "dateReserved": "2026-02-19T19:46:03.542Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T22:42:21.618Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n8n", "vendor": "n8n-io", "versions": [{"status": "affected", "version": "< 1.123.8"}, {"status": "affected", "version": ">= 2.0.0, < 2.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "39CFFDB2-C60B-4006-A603-DBD521531A5B", "versionEndExcluding": "1.123.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "06724F9B-7063-466A-8B43-B10770A2932C", "versionEndExcluding": "2.2.0", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary shell commands on the n8n host. The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. Antes de las versiones 2.2.0 y 1.123.8, un usuario autenticado con permiso para crear o modificar flujos de trabajo pod\u00eda encadenar el nodo Read/Write Files from Disk con operaciones git para lograr la ejecuci\u00f3n remota de c\u00f3digo. Al escribir en archivos de configuraci\u00f3n espec\u00edficos y luego activar una operaci\u00f3n git, el atacante pod\u00eda ejecutar comandos de shell arbitrarios en el host de n8n. El problema ha sido solucionado en las versiones 2.2.0 y 1.123.8 de n8n. Los usuarios deben actualizar a una de estas versiones o posteriores para remediar la vulnerabilidad. Si la actualizaci\u00f3n no es posible de inmediato, los administradores deben considerar las siguientes mitigaciones temporales. Limite los permisos de creaci\u00f3n y edici\u00f3n de flujos de trabajo solo a usuarios de plena confianza, y/o deshabilite el nodo Read/Write Files from Disk a\u00f1adiendo 'n8n-nodes-base.readWriteFile' a la variable de entorno 'NODES_EXCLUDE'. Estas soluciones provisionales no remedian completamente el riesgo y solo deben usarse como medidas de mitigaci\u00f3n a corto plazo."}], "id": "CVE-2026-27498", "lastModified": "2026-06-17T10:27:15.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27498", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:20:10.387603Z", "version": "2.0.3"}}]}, "published": "2026-02-25T23:16:21.213", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/97365caf253978ba8e46d7bc53fa7ac3b6f67b32"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.8"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.2.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.123.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.2.0)"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "n8n", "source": "cna", "vendor": "n8n-io"}, "product": "n8n", "vendor": "n8n"}], "analysis": {"en": {"generated_at": "2026-04-18T10:31:24.610203+00:00", "value": {"mitigation_remediation": ["Upgrade the n8n instance to version 2.2.0 or 1.123.8, or any newer release, to apply the mitigating fix.", "Set the NODES_EXCLUDE environment variable to include n8n-nodes-base.readWriteFile to disable the Read/Write Files from Disk node.", "Limit workflow creation and editing permissions to fully trusted users only. Prevent unauthorized users from accessing or modifying workflows."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is n8n by n8n\u2011io. All releases before 2.2.0 and before 1.123.8 are vulnerable. Users are advised to upgrade to version 2.2.0 or 1.123.8 or any later release to remove the flaw.", "description_and_impact": "The vulnerability allows an authenticated user who can create or edit workflows to write to specific configuration files via the Read/Write Files from Disk node. By subsequently triggering a git operation, the attacker can execute arbitrary shell commands on the n8n host. This flaw represents a classic command injection weakness, categorized as CWE\u201194, and can compromise the confidentiality, integrity, and availability of the entire system.", "risk_and_exploitability": "With a CVSS score of 9 the vulnerability is considered critical. The EPSS score is less than 1%, indicating a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker has authenticated access and the permission to create or modify workflows. The attack path involves writing to a configuration file and then initiating a git operation, which can invoke arbitrary shell commands on the host. The impact is full remote code execution on the affected node."}}}}, "created": "2026-02-26T13:10:43.848293+00:00", "updated": "2026-04-18T10:45:43.642477+00:00", "vendors": ["n8n", "n8n$PRODUCT$n8n"]}