CVE-2026-65591

highCVSS 8.8covered by 2 sourcesfirst seen 2026-07-22

Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process. The legacy expression engine is the default engine in affected versions. Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability. Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Switch to the non-legacy expression engine by setting N8N_EXPRESSION_ENGINE=vm. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

⚡ Watch CVE-2026-65591

Get an email if CVE-2026-65591 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.

Advisory coverage (2)

highGHSA-pm35-fqvh-cq5g: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Executionghsa · 2026-07-22
highCVE-2026-65591: n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-me…nvd · 2026-07-22

External references

NVD record for CVE-2026-65591

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-65591 status](https://www.csirts.com/badge/CVE-2026-65591)](https://www.csirts.com/cve/CVE-2026-65591)