noindex and left out of the sitemap until more data is confirmed.CVE-2026-85165 lets an authenticated n8n user with workflow-edit permission break out of the workflow expression sandbox and mutate shared Node.js process globals that persist across every later expression evaluation until the server restarts, and NVD's own analysis scores it 9.9 critical because of the scope change and the compounding, process-wide impact on confidentiality, integrity and availability.
Vulnerability summary
9.9
Critical
0.6%
EPSS score (FIRST)
No
CISA KEV catalog
2026-09-03
Published
Vulnerability ID: CVE-2026-85165 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| n8n (workflow automation platform) | cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* | before 2.35.4, and 2.36.0 through 2.36.1 per the vendor's fixed-version statement (NVD CPE match data lists the second branch as extending through 2.36.2); fixed in 2.35.4 and 2.36.2 |
What this means
CVE-2026-85165 affects n8n, a widely deployed open-source low-code workflow-automation platform (self-hosted and cloud). n8n lets users write JavaScript "expressions" inside workflow nodes that are evaluated in a restricted sandbox so that a workflow cannot reach outside its intended scope. The sandbox worked by rewriting free (unbound) identifiers in an expression so that they resolve against a controlled sandbox object rather than the real JavaScript environment — but it did not apply that rewriting to identifiers appearing in spread-element, computed-object-key, switch-case, or class-extends positions. Left un-rewritten, those identifiers resolve against the actual Node.js process globals, exposing more than thirty host globals to a workflow expression (GitHub Security Advisory GHSA-fg85-4wv2-p98j).
Because the exposed globals are shared, mutable objects, any authenticated user with permission to edit a workflow could mutate them, and — per n8n's advisory — "the change persisted process-wide across all later expression evaluations until restart," meaning one user's expression could alter behavior seen by every other workflow running on the same n8n instance until an administrator restarted the process (GHSA-fg85-4wv2-p98j).
NVD performed its own CNA analysis and assigned a Primary CVSS v3.1 base score of 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — the S:C (scope changed) component reflects that the impact extends beyond the vulnerable component itself to the shared process state. VulnCheck's own CNA submission rates it CVSS v4.0 7.2 (Secondary) (NVD); the flaw is tracked as CWE-95 (Eval Injection).
n8n's advisory states the issue is fixed in versions 2.35.4 and 2.36.2, meaning deployments on the 2.35.x line should upgrade to 2.35.4 or later and deployments on the 2.36.x line should upgrade to 2.36.2 or later; NVD's own CPE match data lists the second affected branch as extending through 2.36.2 inclusive rather than up to 2.36.1, so operators should treat anything older than the vendor's stated fixed releases as unpatched and confirm their installed build against the n8n release notes directly. As a stopgap, n8n recommends restricting instance access to fully trusted users and, on self-hosted deployments, periodically restarting the process to clear any accumulated mutations — explicitly noting these workarounds do not fully remediate the risk (GHSA-fg85-4wv2-p98j).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00572 (47.3rd percentile) (FIRST EPSS). It is not listed in the CISA Known Exploited Vulnerabilities catalog (checked against catalog version 2026.10.30). Exploitation requires an authenticated account with workflow-edit rights, so instances that grant broad internal access to workflow editing — a common pattern for citizen-developer automation platforms — carry the most risk and should prioritize upgrading over relying on the restart workaround alone.
Evidence
- n8n's expression sandbox does not rewrite free identifiers in spread, computed-key, switch-case, or class-extension positions, letting them resolve against real Node.js process globals; an authenticated user with workflow-edit permission can mutate those shared globals, with the change persisting process-wide until restart. — GitHub Security Advisory
- NVD Primary CVSS v3.1 base score is 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-95; VulnCheck's own CNA submission scores it CVSS v4.0 7.2 (Secondary). — NVD
- Fixed in n8n versions 2.35.4 and 2.36.2; recommended interim mitigations are restricting instance access to trusted users and periodic process restarts, which do not fully remediate the risk. — GitHub Security Advisory
- EPSS score is 0.00572 (47.3rd percentile) as of 2026-10-30; not listed in CISA KEV as of catalog version 2026.10.30. — FIRST EPSS
