Is CVE-2026-27577 actively exploited?

No active exploitation of CVE-2026-27577 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27577 be exploited remotely?

Yes. CVE-2026-27577 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27577?

CVE-2026-27577 has a CVSS score of 9.9 (CRITICAL) and an EPSS exploitation probability of 0.09%.

HOME VULNERABILITIESCVE-2026-27577

CRITICAL

CVE-2026-27577

CWE-94Published: February 25, 2026· Updated: Mar 4, 2026

9.9

CVSS v3.1

EPSS:0.09%probability of exploitation in 30 daysPercentile:25.5th

Official Description

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

NVD Source

Technical Analysis

CVE-2026-27577 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.9.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeChanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Vendors & Products

n8n1 product

n8n

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6

PATCHhttps://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e

ADVISORYhttps://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr

News & Research Mentioning CVE-2026-27577

Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials

The Hacker News· Mar 11, 2026

Cybersecurity researchers have disclosed details of two now-patched security flaws in the n8n workflow automation platform, including two critical bugs that could result in arbitrary command execution. The vulnerabilities are listed below - CVE-2026-27577 (CVSS score: 9.4) - Expression sandbox escape leading to remote code execution (RCE) CVE-2026-27493 (CVSS score: 9.5) - Unauthenticated [xlite_meta score:53 src:The Hacker News xlite_fp:48aab9f8c21f2acc961bdc84f0eb20248a7a59ca830c41c8129b5e78bba40ff7]