CVE-2026-56777
n8n - AST Validator Bypass in Python Code Node
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
n8n - AST Validator Bypass in Python Code Node
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
- Record
CVE-2026-56777- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-184
- Updated
- 2026-11-02
EUVDEUVD-2026-40453
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
- Record
EUVD-2026-40453- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jwm3-qcfw-c5pp
n8n: Python Code Node AST Validator Bypass
Impact
An authenticated user with permission to create or modify workflows containing a Python Code node could bypass the AST security validator and access the task executor module namespace. On self-hosted instances where N8N_BLOCK_RUNNER_ENV_ACCESS=false is set, this extended to disclosure of environment variables accessible to the task runner process.
This issue only affects instances where the Python Task Runner is enabled and N8N_BLOCK_RUNNER_ENV_ACCESS=true.
Patches
The issue has been fixed in n8n versions 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the Python Code node by adding
n8n-nodes-base.codeto theNODES_EXCLUDEenvironment variable, or disable the Python Task Runner entirely.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- Record
GHSA-jwm3-qcfw-c5pp- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-693
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x2rh-rhm8-cv8v
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security...
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
- Record
GHSA-x2rh-rhm8-cv8v- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-184
- Updated
- 2026-11-02
NVD
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
- Record
CVE-2026-56777- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-184
- Updated
- 2026-11-02
OSV
n8n - AST Validator Bypass in Python Code Node
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
- Record
CVE-2026-56777- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-184
- Updated
- 2026-11-02
OSVGHSA-jwm3-qcfw-c5pp
n8n: Python Code Node AST Validator Bypass
Impact
An authenticated user with permission to create or modify workflows containing a Python Code node could bypass the AST security validator and access the task executor module namespace. On self-hosted instances where N8N_BLOCK_RUNNER_ENV_ACCESS=false is set, this extended to disclosure of environment variables accessible to the task runner process.
This issue only affects instances where the Python Task Runner is enabled and N8N_BLOCK_RUNNER_ENV_ACCESS=true.
Patches
The issue has been fixed in n8n versions 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the Python Code node by adding
n8n-nodes-base.codeto theNODES_EXCLUDEenvironment variable, or disable the Python Task Runner entirely.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- Record
GHSA-jwm3-qcfw-c5pp- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-693
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-jwm3-qcfw-c5pp No score
GHSA-jwm3-qcfw-c5pp in n8n - Patched by Root
Root has patched GHSA-jwm3-qcfw-c5pp in the n8n package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-jwm3-qcfw-c5pp- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
n8nnpm |
2.26.0 up to 2.26.2 | 2.26.2 |
n8nnpm |
before 2.25.7 | 2.25.7 |
n8nRoot:npm |
before 2.19.3-aikido.7 | 2.19.3-aikido.72.19.3-aikido.42.19.3-aikido.52.19.3-aikido.62.19.3-aikido.82.19.3-aikido.92.19.3-aikido.102.19.3-aikido.112.19.3-aikido.122.19.3-aikido.132.19.3-aikido.142.19.3-aikido.15 |
@rootio/n8nRoot:npm |
before 2.19.3-root.io.7 | 2.19.3-root.io.72.19.3-root.io.42.19.3-root.io.52.19.3-root.io.62.19.3-root.io.82.19.3-root.io.92.19.3-root.io.102.19.3-root.io.112.19.3-root.io.122.19.3-root.io.132.19.3-root.io.142.19.3-root.io.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-56777 is a medium vulnerability (CVSS 5.3) in N8n, published June 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in n8n 2.26.2.
References
github.com/n8n-io/n8n/security/advisories/GHSA-jwm3-qcfw-c5pp
vulncheck.com/advisories/n8n-ast-validator-bypass-in-python-code-node
nvd.nist.gov/vuln/detail/CVE-2026-56777