CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

• CWE-917

• https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5gMitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-executionThird Party Advisory

Published

Jul 22, 2026

Last Modified

Jul 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65581Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 ver…9.8
• CVE-2026-65582Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versi…7.7
• CVE-2026-65583Apache CXF’s OIDC relying-party token validation could accep…9.1
• CVE-2026-65589n8n versions before 1.123.64 fail to properly mask custom HT…6.5
• CVE-2026-6559A weakness has been identified in Wavlink WL-WN579A3 220323.…5.3
• CVE-2026-65590n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce …9.8
• CVE-2026-65592n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DO…5.4
• CVE-2026-65593n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a s…5.4
• CVE-2026-65594n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.…6.5
• CVE-2026-65595n8n before 2.30.1 and 2.29.8 assigns all Public API key scop…8.8
• CVE-2026-65596n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the…8.1
• CVE-2026-65597n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 co…5.4