LiveActive security incident?Get immediate response
CVE Record

CVE-2026-27493: n8n has Unauthenticated Expression Evaluation via Form Node

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When chained with an expression sandbox escape, this could escalate to remote code execution on the n8n host. The vulnerability requires a specific workflow configuration to be exploitable. First, a form node with a field interpolating a value provided by an unauthenticated user, e.g. a form submitted value. Second, the field value must begin with an `=` character, which caused n8n to treat it as an expression and triggered a double-evaluation of the field content. There is no practical reason for a workflow designer to prefix a field with `=` intentionally — the character is not rendered in the output, so the result would not match the designer's expectations. If added accidentally, it would be noticeable and very unlikely to persist. An unauthenticated attacker would need to either know about this specific circumstance on a target instance or discover a matching form by chance. Even when the preconditions are met, the expression injection alone is limited to data accessible within the n8n expression context. Escalation to remote code execution requires chaining with a separate sandbox escape vulnerability. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Review usage of form nodes manually for above mentioned preconditions, disable the Form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable, and/or disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

CriticalCVSS 9.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2026-27493 affects n8n workflow instances using certain Form node configurations. An unauthenticated person submitting form data could cause n8n expressions to be evaluated unexpectedly. In the worst case, if paired with a separate sandbox escape, this could become remote code execution. The issue is critical, but exploitation requires a specific and reportedly unusual workflow setup.

Executive priority

Prioritize upgrade for any internet-facing or partner-facing n8n deployment using forms. The risk is severe if the rare workflow condition exists, but broad emergency response should be guided by whether affected Form nodes are actually in use.

Technical view

Before n8n 2.10.1, 2.9.3, and 1.123.22, Form nodes could double-evaluate user-controlled values beginning with '='. This is classified as expression injection under CWE-94 and CWE-95. The direct impact is access to data available in the n8n expression context; host code execution requires chaining with another sandbox escape vulnerability.

Likely exposure

Exposure is limited to n8n instances running affected versions with unauthenticated Form workflows where a field interpolates user-submitted values and the resulting value begins with '='. Instances not using Form nodes, or not matching that workflow condition, appear less exposed based on the advisory.

Exploitation context

No source provided here states active exploitation, and KEV is false. The advisory says an attacker would need to know or discover a matching form configuration. Successful escalation beyond expression-context data requires a separate sandbox escape, which is not part of this CVE.

Researcher notes

The vulnerability is second-order: attacker-controlled form input is later treated as an n8n expression due to double evaluation. The advisory emphasizes unusual prerequisites and limited impact without a separate sandbox escape. Avoid assuming universal RCE across all n8n deployments.

Mitigation direction

  • Upgrade n8n to 2.10.1, 2.9.3, 1.123.22, or later.
  • Review Form node workflows for the documented vulnerable preconditions.
  • Temporarily disable the Form node using NODES_EXCLUDE if upgrade is delayed.
  • Temporarily disable the Form Trigger node using NODES_EXCLUDE if upgrade is delayed.
  • Treat node-disabling workarounds as short-term only; they do not fully remediate risk.

Validation and detection

  • Inventory n8n instances and confirm running versions.
  • Identify workflows using Form nodes or Form Trigger nodes.
  • Review Form fields that interpolate unauthenticated user-submitted values.
  • Check whether interpolated field values can begin with '='.
  • Confirm patched versions are deployed after remediation.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-94: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-95: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-27493 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.5 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.5CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——Primary CVE score

Vulnerability scoring details

Base CVSS 4.0 score

9.5Critical
CVSS 4.0 vector shape for CVE-2026-27493Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n8n-ion8n< 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1Listed
Weakness

CWE details

CWE-94CWE-95

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-94 · source CWE mapping

Improper Control of Generation of Code ('Code Injection')

Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-95 · source CWE mapping

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs