CVE-2026-56777

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions 2.26.0 through 2.26.1

Description A security validator bypass exists in the Python Code node involving the Abstract Syntax Tree (AST), which is a tree representation of the abstract syntactic structure of source code. An authenticated user with permissions to create or modify workflows can bypass this validator to access the task executor module namespace. This issue specifically affects self-hosted instances with the Python Task Runner enabled. If the N8N BLOCK RUNNER ENV ACCESS variable is configured to allow access, this could lead to the disclosure of environment variables accessible to the task runner process.

Recommendations Update to version 2.25.7 or later. Update to version 2.26.2 or later.