CVE-2026-56777

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56777

EUVD

EUVD-2026-40453

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 2.25.7 (exc)
n8n	n8n	From 2.26.0 (inc) to 2.26.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability exists in n8n versions before 2.25.7 and 2.26.x before 2.26.2. It involves a bypass of the abstract syntax tree (AST) security validator in the Python Code node. An authenticated user who has permission to create or modify workflows containing a Python Code node can bypass this validator and gain access to the task executor module namespace.

The issue affects only self-hosted instances where the Python Task Runner is enabled. If the environment variable N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this vulnerability can disclose environment variables accessible to the task runner process.

Impact Analysis

This vulnerability can allow an authenticated user with certain permissions to bypass security validation and access sensitive parts of the system, specifically the task executor module namespace.

In self-hosted environments where the Python Task Runner is enabled and environment access is allowed, this can lead to disclosure of environment variables, which may contain sensitive information such as credentials or configuration details.

Mitigation Strategies

To mitigate this vulnerability, update n8n to version 2.25.7 or later, or 2.26.2 or later if you are using the 2.26.x series.

Additionally, if you are running a self-hosted instance with the Python Task Runner enabled, consider disabling the Python Task Runner or configuring the environment variable N8N_BLOCK_RUNNER_ENV_ACCESS to restrict access to environment variables.

Hi! I’m here to help you understand CVE-2026-56777. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70