Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: automation (2 articles)Clear
vulnerability
2026-07-28

n8n sandbox escape lets workflow editors run commands on the server

n8n patched a high-severity flaw that lets an authenticated user who can create or edit workflows escape the expression sandbox and run operating-system commands as the n8n process. Security Joes found it while probing n8n's February fix for an earlier sandbox bug, and the gap sits in how the rewriter handled a bare identifier in a concise arrow function body. Successful exploitation can expose the n8n encryption key and allow decryption of stored credentials. It is tracked as GHSA-gv7g-jm28-cr3m with a score of 8.7 and no CVE assigned yet. Fixed versions are 2.31.5 and 2.32.1, with no patched 1.x release listed.

n8nsandbox-escapeself-hostedcredential-exposureautomation
Check
Update self-hosted n8n to 2.31.5 or 2.32.1 or later, and treat the vendor's interim advice to restrict editing to trusted users as an incomplete stopgap rather than a fix.
Affected
Self-hosted n8n deployments before 2.31.5 or on 2.32.0 (GHSA-gv7g-jm28-cr3m); any account allowed to create or modify workflows can run commands as the n8n process and expose stored credentials.
Fix
Upgrade to a fixed release, rotate the n8n encryption key and stored credentials if you ran an exposed version, and keep the instance off the public internet.
vulnerability
CVE-2026-29059
2026-07-23

Attackers exploit Windmill flaw to read server files and reach superadmin access

VulnCheck reports active exploitation of a path traversal flaw in Windmill, an open source platform for building internal tools, jobs, and workflows. CVE-2026-29059 lets an unauthenticated attacker read arbitrary files through the log file endpoint, and while observed attempts included reading the password file, the higher value target is the superadmin secret. Where that is configured, an attacker can authenticate as a super administrator and run arbitrary code through the job preview API. VulnCheck counted roughly 170 exposed instances across 24 countries, including deployments reachable through a proxy path rather than directly.

windmillpath-traversalactively-exploitedself-hostedautomation
Check
Update Windmill to a fixed release, confirm whether any instance was reachable from the internet, and treat the superadmin secret and any credentials stored in configuration as exposed.
Affected
Organizations running internet-reachable Windmill deployments (CVE-2026-29059); unauthenticated attackers read server files, and where the superadmin secret is set, escalate to full administrative access and code execution.
Fix
Patch to the fixed version, rotate the superadmin secret and stored credentials, keep internal automation platforms off the public internet or behind authentication, and review logs for file read attempts.