CVE-2026-126391
Last modified
CVE-2026-126391 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-126391?
How severe is CVE-2026-126391?
How do I fix CVE-2026-126391?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-126385n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.…7.7
- CVE-2026-126386n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1…4.7
- CVE-2026-126387n8n before 2.46.1 contains an arbitrary file read vulnerabil…5.3
- CVE-2026-126388n8n before 2.46.1 contains a credential exposure vulnerabili…3.7
- CVE-2026-126389n8n before 1.123.89 contains an authentication bypass vulner…5.4
- CVE-2026-126390n8n before 1.123.89 contains a credential leakage vulnerabil…3.7
- CVE-2026-126392Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 conta…3.1
- CVE-2026-126393SiYuan before 3.8.10 contains a server-side request forgery …6.1
- CVE-2026-126394vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vul…5.3
- CVE-2026-126395vLLM from 0.14.0rc1 before 0.31.0 contains an information di…5.3
- CVE-2026-126396vLLM from 0.24.0 before 0.31.0 contains a resource exhaustio…5.3
- CVE-2026-126397vLLM from 0.10.1 before 0.31.0 forwards a request-controlled…7.5
Are you affected by CVE-2026-126391?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST