CVE-2026-27497

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could leverage the Merge node's SQL query mode to execute arbitrary code and write arbitrary files on the n8n server. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Merge node by adding `n8n-nodes-base.merge` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

An insider or compromised developer account with workflow editing rights in n8n creates a new workflow containing a Merge node in SQL query mode. The attacker crafts a payload exploiting CWE-89/CWE-94 to achieve server-side code execution — writing a web shell or spawning a reverse shell. Once on the server, they harvest all n8n-stored credentials: LLM API keys (OpenAI, Anthropic), vector database connections, cloud provider tokens, internal database credentials. These are used to pivot: querying LLMs with exfiltrated proprietary data, poisoning RAG databases, or deploying rogue AI agent workflows that persist under legitimate service accounts. The attack is inherently stealthy because workflow execution logs it as normal n8n activity.