n8n Published Two CVEs in One Day: Expression Sandbox Escape (CVE-2026-86076) and Argument Injection (CVE-2026-44790)
n8n disclosed two CVEs on Oct 5, 2026: CVE-2026-86076 (CVSS 8.7, expression sandbox escape) and CVE-2026-44790 (CVSS 9.4). Patch guide for self-hosters.