No-Code AI Automation: n8n's $5.2B Mark and Activepieces CVEs

Two stories from the same market

The workflow automation market now has two very different stories. One is about money. SAP's investment pushed n8n's valuation to $5.2 billion. The other is about security. Activepieces, an open-source competitor, has built up a run of disclosed vulnerabilities in its code-execution and AI-agent features. Taken together, they show what enterprises reward in this category and what they should be checking before they buy.

What SAP actually bought

SAP announced a strategic investment in n8n on May 12, 2026, at its Sapphire customer conference. It came with a multi-year commercial agreement to embed n8n's workflow canvas inside Joule Studio, SAP's platform for building AI agents 2. The deal set n8n's valuation at $5.2 billion. That is more than double the $2.5 billion mark from its $180 million Series C in October 2025, seven months earlier 12.

The headline number needs some context. SAP took a stake of just under 1.3%, and it did so through a secondary share sale 1. In a secondary sale, an investor buys existing shares from current holders rather than putting new money into the company. So the $5.2 billion figure is a price set on a small block of stock by a buyer with a strategic reason to pay up. It is not a large primary round that tested broad investor demand.

The revenue picture adds a second caveat. n8n's disclosed ARR was roughly $40 million when the Series C term sheet was signed 1. Dividing $5.2 billion by that figure gives a multiple of about 130x. That number is almost certainly too high, because the ARR figure is months out of date and the company has presumably grown since. Still, n8n is priced well beyond typical software benchmarks. The comparisons drawn with Zapier and Make.com point the same way 1.

One take frames the doubling as "the strongest enterprise-trust signal in workflow automation right now" and a reason for buyers to commit 2. That reading makes sense if you treat the Joule Studio integration as the real news. An enterprise vendor wiring a third-party tool into its own agent-building product is a meaningful endorsement. Treating the valuation itself as proof of enterprise readiness is harder to defend, given how small the transaction was.

The Activepieces vulnerability trail

Activepieces describes itself as an open-source AI workflow automation platform. OpenCVE lists eight CVEs against the project 4. Several of the most recent share a theme: the features that make AI automation powerful are the same ones that create attack surface.

• CVE-2026-73082 (server-side request forgery). Before version 0.82.0, an endpoint used to validate MCP tools for agents would make outbound HTTP or SSE requests to any URL the user supplied, with no validation. An authenticated user could point the server at internal services or cloud metadata endpoints, or use it to probe the network 3.
• CVE-2026-73083 (sandbox escape). Before 0.80.0, in SANDBOX_CODE_ONLY mode, user code was loaded before the V8 isolate took effect. Top-level code could therefore reach Node.js APIs such as child_process and the filesystem. Anyone able to create a Code step could read secrets including AP_ENCRYPTION_KEY and AP_JWT_SECRET 4.
• CVE-2026-73081 (command injection). Also fixed in 0.80.0, this flaw let shell metacharacters in a Code step's name break out of a shell-invoked build command 4.

All three require authentication. All have been patched. Neither point removes the risk on platforms where many employees can build workflows, because broad authoring access is how no-code tools are meant to be used. In that setting, "authenticated user" can describe a large share of the company. Teams running Activepieces themselves should confirm they are on 0.82.0 or later.

Where this leaves buyers

The competitive field keeps expanding. One October 2026 ranking puts n8n first and praises its AI-native nodes and its range of uses, from IT onboarding to DevOps. The same list highlights Windmill as a developer-oriented open-source entrant 5. It credits Activepieces with growing from 15 launch connectors to a large, community-extended library. It also notes that Make.com has added AI Agents and MCP Tools integration 5.

That last point matters. MCP connectivity and in-workflow code execution are becoming standard features across the category, and they are the exact areas where Activepieces' flaws appeared. These look less like one vendor's carelessness and more like a warning about what every platform now exposes.

Here is the bottom line. n8n's valuation shows that strategic buyers will pay heavily for distribution inside enterprise AI stacks. It does not show that any automation platform is secure. As these tools gain the ability to run code and call external agent tools, security reviews should focus on sandboxing, outbound-request controls and secrets handling.