n8n Workflow Automation Platform Triple Vulnerability Chain Enables Server Takeover (CVE-2026-65591 / CVE-2026-65592 / CVE-2026-65598)

Scope: n8n Versions Prior to 1.123.64, 2.29.8, and 2.30.1 (Self-Hosted and Cloud)

Severity: Red

Three vulnerabilities disclosed July 22, 2026, in n8n, a widely deployed open-source workflow automation platform, combine to give an attacker with basic workflow creation permissions full server-level code execution and session hijacking capability against any user who opens a shared workflow. CVE-2026-65591 (CVSS 9.6) is an expression language injection in n8n's legacy expression evaluator that allows sandbox escape and arbitrary code execution on the host OS. CVE-2026-65598 is a TOCTOU race condition in the Git node's clone operation allowing path restriction bypass, planting of a crafted repository in the community node directory, and automatic code execution on server restart. CVE-2026-65592 is a stored DOM XSS in the Resource Locator component that passes attacker-controlled javascript: URI schemes to window.open() without validation, executing malicious scripts in the session of any user who opens the crafted workflow, including administrators. Given that n8n is increasingly adopted by Ugandan enterprise teams for automating IT and business workflows, organizations must upgrade to n8n versions 1.123.64, 2.29.8, or 2.30.1 immediately, restrict workflow creation and editing access to fully trusted users only where patching is delayed, and audit existing workflow JSON for javascript: URI prefixes in node parameters.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.