n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-42234
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 4, 2026
- Source last modified
- June 17, 2026
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This issue only affects instances where the Python Task Runner is enabled. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Description quoted from the NVD record.
Who is affected
n8n is a tool for connecting apps and automating routine tasks through workflows. This flaw affects versions before 1.123.32, 2.17.4 and 2.18.1, and only setups where the Python task runner (the feature that runs Python code inside workflows) is turned on. A signed-in user who is allowed to create or change workflows that include a step running Python code could break out of the protected space meant to contain that code. They could then run any commands they choose on the separate system that carries out workflow code. This flaw is rated High.
What to do
- If someone in your organization installed or runs n8n, that person should check which version is in use and whether the Python task runner is turned on.
- That person should update n8n to version
1.123.32,2.17.4or2.18.1(or later), choosing the fixed version that matches the release line you use. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- For more detail on the fix, read the vendor advisory linked on this page.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.