Dashboard / CVE-2026-72764

CVE-2026-72764

MEDIUM
MEDIUM Priority: 0.05 BB Relevance: 62/100
Published: 2026-08-11 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: Present
VC: None
VI: None
VA: None

Description

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected.

Weakness Classification (1)

Affected Software (8)

VendorProductVersion
n8n n8n < 1.123.67
n8n n8n 2.32.0
n8n-io n8n 0 < 1.123.67
n8n-io n8n 2.32.0 < 2.32.1
n8n-io n8n 2.0.0-rc.0 < 2.31.5
n8n-io n8n 0 < 1.123.67
n8n-io n8n 2.32.0 < 2.32.1
n8n-io n8n 2.0.0-rc.0 < 2.31.5

References & Advisories (2)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

EPSS — Exploitation Probability

0.81%
Raw Score 0.008130
Percentile 56.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00813
2026-10-28
0.00813

Intelligence Sources

mitre ref →
nvd ref →

External Links