CVE-2026-56777: n8n Python Code Node AST Validator Bypass & Credential Disclosure

Technical summary

The vulnerability exists in n8n's AST (Abstract Syntax Tree) security validator for the Python Code node. The validator is designed to restrict what code can execute within Python workflows, but an authenticated attacker can craft malicious code that circumvents these restrictions and accesses the task executor module namespace. When the N8N_BLOCK_RUNNER_ENV_ACCESS environment variable is configured permissively, this allows disclosure of environment variables that would normally be protected. The issue affects versions before 2.25.7 and all 2.26.x versions before 2.26.2.

Business impact

Organizations running self-hosted n8n instances with Python task execution enabled face credential exposure risk. If an attacker or malicious insider with workflow modification permissions exploits this flaw, they could exfiltrate secrets stored as environment variables—potentially including database passwords, API keys, cloud credentials, and other sensitive configuration data. The impact depends on what credentials are exposed and how broadly those credentials are used. For organizations using n8n as a central automation hub, this could enable lateral movement or unauthorized access to downstream systems.

Affected systems

Only self-hosted n8n instances are vulnerable. Specifically, the vulnerability requires: (1) n8n version before 2.25.7 or 2.26.0–2.26.1; (2) Python Task Runner enabled; and (3) N8N_BLOCK_RUNNER_ENV_ACCESS configured to allow environment variable access. Cloud-hosted n8n.cloud instances are not affected because they do not expose the Python Task Runner feature. The vulnerability does not affect instances where Python Code nodes are disabled or where N8N_BLOCK_RUNNER_ENV_ACCESS is set to deny access.

Exploitability

Exploitability is moderate. An attacker must already have authenticated access to n8n and possess permissions to create or modify workflows—these are typically restricted to trusted internal users or administrators. However, once those preconditions are met, the attack requires no external interaction (CVSS AV:N/AC:L/PR:L/UI:N) and can be executed remotely. The validator bypass is likely reliable and does not require guessing or timing attacks. The threat is primarily from insider threats or from compromised credentials of legitimate users rather than unauthenticated external attack.

Remediation

Upgrade n8n immediately: to version 2.25.7 or later if on the 2.25.x branch, or to version 2.26.2 or later if on 2.26.x. Organizations unable to patch immediately should restrict workflow creation and modification permissions to only highly trusted administrators, and consider disabling the Python Task Runner if it is not actively used. Review which environment variables are currently exposed to the task runner and rotate or revoke any that are sensitive, particularly database credentials and external API keys.

Patch guidance

Patches are available: n8n 2.25.7 and n8n 2.26.2 fix the AST validator bypass. Verify the specific patch version against the vendor advisory before deploying. Self-hosted deployments should prioritize this update, especially if Python Code nodes are in active use. Consider testing the patch in a staging environment first to ensure compatibility with existing workflows. The patches address the underlying validator logic, so no configuration changes should be necessary post-upgrade.

Detection guidance

Monitor n8n audit logs for Python Code nodes that reference suspicious module imports (e.g., 'task_executor', 'os', 'sys') or that attempt to access the task executor namespace. Look for workflows created or modified by users with limited workflow permissions, as this may indicate a compromised account. If N8N_BLOCK_RUNNER_ENV_ACCESS is enabled, check for unusual Python Code node activity that exfiltrates environment variables or credential data. Organizations should also review their environment variable exposure policies and confirm that N8N_BLOCK_RUNNER_ENV_ACCESS is set conservatively when Python task execution is needed.

Why prioritize this

This vulnerability should be prioritized if your organization runs self-hosted n8n with Python task execution enabled. The CVSS score of 5 reflects the moderate impact (credential disclosure only, no system compromise), but the exploitability is straightforward for insiders or users with workflow creation permissions. The real-world risk depends on how tightly access to n8n workflows is controlled and what secrets are exposed as environment variables. Organizations with strict workflow permission controls and minimal sensitive data in environment variables may deprioritize; those with loose permissions or rich environment variable exposure should patch urgently.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) reflects a network-accessible vulnerability (AV:N) requiring only low privilege and no user interaction (AC:L/PR:L/UI:N), with confidentiality impact (C:L) but no integrity or availability impact. The scope is changed (S:C), indicating impact beyond the vulnerable component. The moderate score appropriately weights the credential disclosure risk against the requirement for prior authentication and specific configuration. This is not a critical remote code execution flaw, but it does enable sensitive information leakage for authenticated attackers.

Frequently asked questions