CVE-2026-49444: n8n Python Code Node Sandbox Escape – Arbitrary Code Execution

Technical summary

The vulnerability exists in n8n's Python Code Node execution environment, which is designed to sandbox user-provided Python code. Prior to the patched versions, insufficient input validation and sandbox isolation controls (CWE-20) allow an authenticated user with workflow creation or modification permissions to escape the sandbox environment and achieve unauthenticated code execution on the underlying task runner container. The attack surface is the Python Code Node's handling of code input during workflow execution, where sanitization or isolation mechanisms can be bypassed through crafted payloads.

Business impact

Organizations using n8n for critical workflow automation face potential data theft, lateral movement, and service disruption. An attacker with valid n8n credentials—whether through compromise, insider threat, or excessive permission delegation—can execute malicious code on the task runner, potentially accessing sensitive data, modifying workflow outputs, poisoning downstream systems, or pivoting to other infrastructure. The risk is elevated in environments where n8n integrates with databases, APIs, or file systems containing confidential information.

Affected systems

n8n versions 1.x prior to 1.123.48, 2.x prior to 2.21.8, and all 2.22.x versions prior to 2.22.4 are affected. Self-hosted instances and cloud deployments running these versions are vulnerable if they allow workflow creation by multiple users or untrusted actors. The vulnerability does not affect n8n installations where workflow creation is restricted to trusted administrators only.

Exploitability

Exploitation requires valid n8n credentials with workflow creation or modification rights—a realistic scenario in most organizations where workflow developers or integration specialists have these permissions. No user interaction or advanced techniques are needed once authenticated; the attacker can inject malicious code directly into a Python Code Node and trigger execution. The public availability of n8n and clear attack surface make this a moderate-to-high concern, though the requirement for authentication prevents opportunistic mass exploitation.

Remediation

Upgrade immediately to n8n version 1.123.48, 2.21.8, or 2.22.4 or later, depending on your deployment branch. These versions restore proper sandbox isolation and input validation. If immediate upgrade is not feasible, restrict workflow creation and modification permissions to fully trusted administrators and monitor Python Code Node execution for suspicious activity.

Patch guidance

Deploy the fixed versions as soon as testing permits. For version 1.x deployments, upgrade to 1.123.48 or migrate to the 2.x branch if lifecycle allows. For 2.21.x, upgrade to 2.21.8. For 2.22.x, upgrade to 2.22.4. Verify the upgrade with vendor advisory documentation. Test workflow execution in a staging environment to confirm compatibility before production deployment. Consider automating updates if your deployment model supports it.

Detection guidance

Monitor n8n audit logs for workflow creation or modification by unexpected users, particularly those who lack legitimate automation responsibilities. Watch for Python Code Node workflows that attempt to import system libraries, access environment variables, or execute shell commands—legitimate workflows typically use n8n's built-in nodes for such operations. Flag workflows with obfuscated or encoded code. In containerized deployments, monitor task runner processes for unusual child process spawning or file system access outside expected workflow directories. Implement egress filtering to limit outbound connections from task runner containers.

Why prioritize this

This vulnerability merits immediate attention because it enables arbitrary code execution on critical infrastructure with authentication alone—no complex exploitation chains required. The combination of HIGH CVSS (8.5), broad impact on task runner environments, and realistic attack surface in multi-user n8n deployments makes it a top-tier priority. Organizations should treat this as a 'patch immediately' issue unless n8n is air-gapped and accessible only to administrators.

Risk score, explained

CVSS 8.5 (HIGH) reflects the High impact on confidentiality, limited impact on integrity, no impact on availability, network-accessible attack vector, low attack complexity, and requirement for low-privileged authentication. The scope-changed rating elevates the score because an authenticated user can affect the task runner container and potentially connected systems. The score would be Critical if availability impact were included or if unauthenticated access were possible.

Frequently asked questions