{"id":"CVE-2026-119408","kind":"vulnerability","aliases":["CVE-2026-119408"],"related":[],"title":"n8n: deprecated Function nodes let authenticated users run code on server","description":"n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.","summary":"n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 lets authenticated users who can create, modify, or import workflows run JavaScript in the n8n main process through deprecated Function, Function Item, and LangChain Code nodes. The affected nodes run outside task runner isolation, so the attacker can execute code with the privileges of the n8n server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langchain","n8n","self-hosted","workflow-automation"],"not_affected_if":["fixed-version","no-workflow-editor-access"],"how_to_check":"- Check the installed n8n version with `n8n --version` or the image tag in your deployment.\n- Look for workflows that use the deprecated Function, Function Item, or LangChain Code node types.\n- Confirm whether task runner isolation is enabled for your n8n instance.","fix":"- n8n `2.42.6` for the 2.42 line\n- n8n `2.43.3` for the 2.43 line\n- n8n `3.0.1` for the 3.x line","status":"open","published_at":"2026-10-30T12:16:37+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:32:00+00:00","updated_at":"2026-10-30T12:32:00+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-30T12:32:00Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.42.6` for the 2.42 line\n- n8n `2.43.3` for the 2.43 line\n- n8n `3.0.1` for the 3.x line","reach":"network","title":"n8n: deprecated Function nodes let authenticated users run code on server","impact":"high","summary":"n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 lets authenticated users who can create, modify, or import workflows run JavaScript in the n8n main process through deprecated Function, Function Item, and LangChain Code nodes. The affected nodes run outside task runner isolation, so the attacker can execute code with the privileges of the n8n server.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","workflow-automation","langchain"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary JavaScript inside the n8n main process server","analyst_note":"Confirm the exact affected and fixed version ranges and whether task runner isolation changes exposure, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119408 and the n8n advisory.","how_to_check":"- Check the installed n8n version with `n8n --version` or the image tag in your deployment.\n- Look for workflows that use the deprecated Function, Function Item, or LangChain Code node types.\n- Confirm whether task runner isolation is enabled for your n8n instance.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-workflow-editor-access"],"who_is_affected":"Self-hosted or managed n8n instances where users can create, edit, or import workflows are exposed, since the flaw needs an authenticated account with workflow rights. Instances that only run pre-approved workflows from trusted users, or that are on the fixed versions, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4166,"output_tokens":720,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119408':14A,17A '-2026':13A,16A '2.42.6':31B,90C '2.43':32B,91C '2.43.3':35B,94C '3':37B,96C '3.0.1':40B,99C 'affect':68B 'ai':19B 'ai-tool':18B 'attack':77B 'authent':6A,42B,120C 'autom':28B 'code':9A,65B,80B,103C,113C 'contain':100C 'creat':46B,124C 'cve':12A,15A 'deprec':2A,59B,107C 'execut':79B,104C,135C 'function':3A,60B,61B,108C,109C 'hidden':131C 'host':25B 'import':49B,127C 'isol':74B,119C 'item':62B,110C 'javascript':52B,136C 'langchain':21B,64B,112C 'let':5A,41B 'main':56B,140C 'modifi':47B,125C 'n8n':1A,22B,29B,55B,86B,88C,139C 'name':129C 'node':4A,66B,69B,114C,132C 'outsid':71B,116C 'privileg':83B 'process':57B,141C 'remot':102C 'run':8A,51B,70B,115C 'runner':73B,118C 'self':24B 'self-host':23B 'server':11A,87B 'task':72B,117C 'tool':20B 'type':133C 'user':7A,43B,121C 'via':106C 'vulner':105C 'workflow':27B,50B,128C 'workflow-autom':26B 'x':33B,38B,92C,97C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed n8n instances where users can create, edit, or import workflows are exposed, since the flaw needs an authenticated account with workflow rights. Instances that only run pre-approved workflows from trusted users, or that are on the fixed versions, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119408","severity":null,"published_at":"2026-10-30T12:16:37+00:00","modified_at":"2026-10-30T12:16:37+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}