Security readout for executives and security teams
Plain-English summary
CVE-2026-27578 lets a trusted-but-malicious n8n workflow editor store browser-executed script in certain workflow nodes. When another user opens the affected n8n-rendered page, the script can run in their browser, risking session theft and account takeover.
Executive priority
Prioritize remediation for any n8n instance where multiple users can edit workflows. This is high risk because successful abuse may let an insider or compromised editor account take over other users’ sessions.
Technical view
n8n versions before the listed fixed releases are affected by stored XSS across Form Trigger, Chat Trigger, Send & Wait, Webhook, and Chat nodes. The CVSS 4.0 score is 8.5. Required attacker access is low-privileged authenticated workflow create or edit permission, with victim page interaction required.
Likely exposure
Organizations running self-hosted or managed n8n instances with unpatched affected versions and users allowed to create or modify workflows are exposed. Risk is higher where workflow editing is broadly delegated.
Exploitation context
The source bundle does not indicate known active exploitation, and KEV is false. Exploitation requires an authenticated user with workflow editing rights and another user visiting an affected rendered page.
Researcher notes
There is a source inconsistency: affected ranges state 1.x versions before 1.123.22, while the description says fixed in 1.123.21. Do not assume the lower 1.x fix without confirming vendor advisory updates.
Mitigation direction
- Upgrade n8n to 2.10.1 or later where applicable.
- For 1.x, verify vendor guidance because source version details are inconsistent.
- Restrict workflow creation and editing to fully trusted users only.
- Temporarily disable the Webhook node using vendor-documented NODES_EXCLUDE guidance.
- Treat workarounds as temporary; they do not fully remediate the vulnerability.
Validation and detection
- Inventory all n8n instances and record exact versions.
- Identify users and roles with workflow create or edit permissions.
- Review workflows using the named affected nodes.
- Confirm upgraded instances report a fixed vendor-supported version.
- Check vendor advisory for updated fixed-version clarification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-80: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27578 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92CVE reference · x_refsource_CONFIRM
- https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534aCVE reference · x_refsource_MISC
- https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6CVE reference · x_refsource_MISC
- https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882eCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.