n8n Patches Sandbox Escape That Let Editors Run Commands on the Server
A flaw in the popular automation platform let anyone with workflow-editing access break out of the safe zone and run system commands. n8n has issued a fix.
Key points
- N8n has patched a high-severity flaw that let authenticated workflow editors run operating-system commands on the server.
- Security Joes found the bug while probing whether the February fix for CVE-2026-27577 could be bypassed. It could.
- Versions before 2.31.5 and version 2.32.0 are vulnerable; 2.31.5 and 2.32.1 are fixed.
- Self-hosted users should update now; cloud customers are patched automatically.
N8n, an open-source tool that lets companies stitch together apps and automate tasks without much custom code, has fixed a serious security flaw. Someone who could already log in and edit workflows could escape the platform's sandbox, the walled-off area meant to stop user-written code from touching the wider system, and run commands directly on the host machine. We first covered n8n's security record on 16 July 2026, when a login bug let a valid token from one provider authenticate as a different user; the platform is back in the same conversation.
How serious is this?
Serious, but not a drive-by. An attacker needs an account with permission to edit workflows, which rules out random internet traffic. It doesn't rule out a rogue insider, a contractor whose access was never revoked, or an outsider who phished a valid login.
Once inside, the attacker runs commands as the n8n process itself: reading files the server holds, pulling API keys stored for automations, and pivoting to connected systems. For many organisations that connection list is long, covering CRMs, databases, cloud accounts and internal tooling.
Which versions are affected?
The flaw sits in a broad slice of recent releases. N8n has published the specifics, first reported by The Hacker News.
| Status | Version range |
|---|---|
| Vulnerable | Before 2.31.5 |
| Vulnerable | 2.32.0 |
| Patched | 2.31.5 |
| Patched | 2.32.1 |
If you self-host n8n, check your version now. Cloud-hosted customers are updated by n8n directly.
How did the researchers find it?
By assuming the first fix wasn't the last word. Security Joes treated the February patch, tracked as CVE-2026-27577, as a starting point rather than a finish line, then probed the same sandbox from a fresh angle and found another exit.
That's a common pattern. Running untrusted code inside a language runtime and expecting it to stay put is hard to get right. One patch often closes a door while leaving a window open, a dynamic we also saw in the Claude Cowork sandbox escape we reported on 23 July 2026.
What should n8n users do now?
Update. Move self-hosted instances to 2.31.5 or 2.32.1 as soon as your change process allows. If you can't patch immediately, tighten who can edit workflows: audit the user list and drop dormant accounts. Require strong authentication on every editor login.
After patching, use this as a prompt to review what your automations can actually reach. If a single workflow touches production databases and cloud billing, ask whether it should. Least privilege applies to bots as much as to people.
There's no public report of exploitation in the wild. That can change quickly once patch details circulate, so speed matters.
