n8n-io/n8n · error · ConfigurationError

Wildcard '*' in {list_name} must be used alone, not with oth

Error message

Wildcard '*' in {list_name} must be used alone, not with other modules. Got: {', '.join(sorted(modules))}

What it means

Thrown by parse_allowlist in the Python task runner when the wildcard '*' is combined with other module names in the same allowlist string. The wildcard means 'allow everything', so listing additional modules alongside it is contradictory and indicates a configuration error. This validation runs at startup when parsing any of the module allowlist environment variables.

Source

Thrown at packages/@n8n/task-runner-python/src/config/task_runner_config.py:41

    ENV_TASK_TIMEOUT,
    ENV_AUTO_SHUTDOWN_TIMEOUT,
    ENV_GRACEFUL_SHUTDOWN_TIMEOUT,
    PIPE_MSG_MAX_SIZE,
)


def parse_allowlist(allowlist_str: str, list_name: str) -> set[str]:
    if not allowlist_str:
        return set()

    modules = {
        module
        for raw_module in allowlist_str.split(",")
        if (module := raw_module.strip())
    }

    if "*" in modules and len(modules) > 1:
        raise ConfigurationError(
            f"Wildcard '*' in {list_name} must be used alone, not with other modules. "
            f"Got: {', '.join(sorted(modules))}"
        )

    return modules


@dataclass
class TaskRunnerConfig:
    grant_token: str
    # Empty to self-assign an ID, the default in `external` mode where no one else
    # knows this runner beforehand. Must be unique per runner when set: the broker keys
    # connections by runner ID, so two runners sharing one keep evicting each other.
    runner_id: str
    task_broker_uri: str
    max_concurrency: int
    max_payload_size: int
    task_timeout: int

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Use '*' alone to allow all modules: set the variable to just '*'.
2. Or remove '*' and list only the specific modules you need: 'os,sys,json'.
3. Review which allowlist variable triggered the error (the list_name in the message tells you which one).
4. Restart the runner after fixing the environment variable.

Example fix

# before
export PYTHON_FUNCTION_ALLOW_EXTERNAL='*,requests,os'
# after — option 1: allow all
export PYTHON_FUNCTION_ALLOW_EXTERNAL='*'
# after — option 2: allow specific
export PYTHON_FUNCTION_ALLOW_EXTERNAL='requests,os'

def validate_allowlist(value: str, name: str) -> set[str]:
    modules = {m.strip() for m in value.split(',') if m.strip()}
    if '*' in modules and len(modules) > 1:
        raise ValueError(f"Wildcard must be alone in {name}")
    return modules

# validate before the runner parses it
validate_allowlist(os.environ.get('PYTHON_FUNCTION_ALLOW_EXTERNAL', ''), 'external_allowlist')

from config.task_runner_config import ConfigurationError

try:
    config = TaskRunnerConfig.from_env()
except ConfigurationError as e:
    if 'Wildcard' in str(e):
        print('Fix allowlist: use * alone OR list specific modules')
    sys.exit(1)

When it happens

Trigger: An allowlist environment variable (e.g. one feeding stdlib_allow or external_allow) is set to a comma-separated string containing '*' alongside other entries, like '*,os,sys' or 'requests,*. The set is built from the split string, then the check `'*' in modules and len(modules) > 1` fires.

Common situations: Gradually adding specific modules to an existing wildcard allowlist without removing '*'. Copy-pasting from documentation that showed both forms. Misunderstanding that '*' means 'allow all' rather than 'also allow these plus everything'.

Related errors

• Security violation detected
• Module '${moduleName}' is disallowed
• Port must be between 0 and 65535, got {port}
• Environment variable N8N_RUNNERS_GRANT_TOKEN is required
• Task timeout must be positive, got {task_timeout}

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/19561fe19c2bcc05. Report an issue: GitHub.