Skip to main content
CRITICAL

CVE-2026-1470

CVSS v3

9.9

CRITICAL

EPSS Score

20.7 %

exploit probability, as of 2026-10-05

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including una

Technical details

Published
2026-01-27
Last Modified
2026-02-20

Frequently asked questions

What is CVE-2026-1470?

n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including una

Is CVE-2026-1470 actively exploited?

Active exploitation of CVE-2026-1470 has not been confirmed. Its EPSS score was 20.7% on 2026-10-05, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-1470?

CVE-2026-1470 has a CVSS v3 base score of 9.9 (CRITICAL severity).

Is CVE-2026-1470 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 50 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database