CVE-2026-56777
n8n - AST Validator Bypass in Python Code Node
CVSS Score
5.0
EPSS Score
0.0%
EPSS Percentile
0th
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.
| CWE | CWE-184 |
| Vendor | n8n |
| Product | n8n |
| Published | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n n8n
Be the first to know when new medium vulnerabilities affecting n8n n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
n8n / n8n
0 < 2.26.2
n8n / n8n
0 < 2.25.7
References
Credits
🔍 Mistz1