Dashboard / CVE-2026-65590

CVE-2026-65590

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 56/100
Published: 2026-07-22 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: X
AT: Present
VC: None
VI: None
VA: None

Description

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
n8n n8n < 2.29.8
n8n n8n < 2.29.8
n8n n8n 2.30.0
n8n n8n 2.30.0
n8n-io n8n 2.30.0 < 2.30.1

References & Advisories (2)

Bug Bounty Relevance

56 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.5 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.58%
Raw Score 0.005840
Percentile 47.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00584
2026-10-28
0.00584

Intelligence Sources

mitre ref →
nvd ref →

External Links