CVE-2026-72764
Received Received - Intake

Module Cache Poisoning in n8n JavaScript Task Runner

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72764
EUVD
EUVD-2026-56143

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.67 (exc)
n8n n8n to 2.31.5 (exc)
n8n n8n to 2.32.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a module cache poisoning issue in n8n's JavaScript task runner. It affects multi-user instances where the JS task runner is enabled with built-in or external modules. A user running a Code node can poison the shared module cache, which alters other users' Code-node executions on the same runner. This breaks cross-user isolation but does not allow sandbox escape or remote code execution.

Detection Guidance

Check n8n version with 'n8n --version' or inspect package.json. Look for multi-user instances with JavaScript task runner enabled and module access configured. Monitor logs for unusual Code node executions or module cache modifications.

Impact Analysis

If you are a user on a multi-user n8n instance with the JS task runner enabled, an attacker could alter your Code-node executions. This could compromise the confidentiality, integrity, or availability of your data. The impact is limited to other users on the same runner within the same n8n instance.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data processed by n8n workflows. This may violate compliance requirements under GDPR (data confidentiality) or HIPAA (protected health information integrity). Organizations must ensure proper isolation and access controls to maintain compliance.

Mitigation Strategies

Upgrade n8n to patched versions (1.123.67, 2.31.5, or 2.32.1). Disable module access in Code nodes if not required. Restrict Code node access to trusted users only. Consider using external runner mode with dedicated runners per user or project.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72764. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart