Critical Zero-Click Flaw in n8n Allows Full Server Compromise

Researchers at Pillar Security disclosed two critical vulnerabilities in n8n (CVE-2026-27493 and CVE-2026-27577) that permit remote code execution and sandbox escape. CVE-2026-27493 is an unauthenticated, zero-click double-evaluation bug in Form nodes that can run arbitrary shell commands via public form inputs, and CVE-2026-27577 is a sandbox escape in the expression compiler allowing authenticated attackers to achieve full RCE and read the N8N_ENCRYPTION_KEY to decrypt stored credentials. Both cloud and self-hosted instances are affected; n8n Cloud likely received automated patches while self-hosted users are urged to upgrade to the specified patched versions and rotate stored credentials.