n8n Published Two CVEs in One Day: Expression Sandbox Escape (CVE-2026-86076) and Argument Injection (CVE-2026-44790)

Описание и применение

В n8n обнаружены две критические уязвимости, позволяющие получить полный контроль над сервером. Патчинг до версий 1.123.76, 2.37.7 или 2.38.2 устраняет проблему.

Задача

Two critical CVEs in n8n allow full server control via expression sandbox escape and argument injection.

Результат

After following the steps, the n8n instance runs a patched version, eliminating the CVE-2026-86076 and CVE-2026-44790 vulnerabilities and restoring secure operation.

Рабочий процесс

• 1. Back up n8n data and N8N_ENCRYPTION_KEY via Docker volume tar or pg_dump.
• 2. Pull the fixed image: docker pull n8nio/n8n:2.38.2 (or 1.123.76 / 2.37.7).
• 3. Stop and remove the old container: docker stop n8n && docker rm n8n.
• 4. Run the new container with the same env-file, volumes, and port mapping: docker run -d --name n8n --env-file /path/to/your/n8n.env -v n8n_data:/home/node/.n8n -p 5678:5678 n8nio/n8n:2.38.2.
• 5. Verify the version: docker exec n8n n8n --version and check Settings → About in the UI.
• 6. Audit users and workflows for untrusted expression authors and review recent changes for suspicious expressions like __sanitize, constructor, or Function.

Доказательства

n8n disclosed two security advisories in a single day — both able to hand an attacker full control of the server your workflows and agents run on.

Источник

upgrade to n8n 1.123.76, 2.37.7, or 2.38.2 depending on your release line.

Источник

The patch rejects reserved class-member names like __sanitize, closing the rebinding path.

Источник