n8n at a glance
n8n disclosed CVE-2026-21858, which lets unauthenticated attackers read server files through some form-based workflows, plus CVE-2026-21877, an authenticated code execution bug. Fixes are in 1.121.0 and 1.121.3.
n8n: status
- Affected
- n8n 1.65.0 up to but not including 1.121.0 (CVE-2026-21858)
- n8n 0.123.0 up to but not including 1.121.3, self-hosted and n8n Cloud (CVE-2026-21877)
- Status as of
- Discovered by
- Dor Attias, Cyera Research Labs (CVE-2026-21858); reporter theolelasseux (CVE-2026-21877)
What changed with n8n
On January 7, 2026, n8n published GHSA-v4pr-fm98-w9pg for CVE-2026-21858, rated critical with a CVSS 3.1 score of 10.0. In n8n 1.65.0 up to but not including 1.121.0, certain form-based workflows let a remote attacker with no credentials access files on the underlying server. Cyera Research Labs, which named the bug Ni8mare, describes how leaked secrets can be chained into admin access and command execution.
A day earlier n8n also published GHSA-v364-rw7m-3263 for CVE-2026-21877 (CVSS 9.9). An authenticated user could get untrusted code to run on the n8n service through an arbitrary file write, affecting self-hosted and n8n Cloud instances from 0.123.0 up to 1.121.3. n8n suggests disabling the Git node and limiting untrusted users if you cannot upgrade yet.
n8n says there is no official workaround for CVE-2026-21858 beyond upgrading; as a stopgap, restrict or disable publicly reachable webhook and form endpoints. Upgrading to 1.121.3 or later covers both advisories.
How to fix it: n8n
1. Update
Upgrade n8n to 1.121.3 or later, which includes the 1.121.0 fix for CVE-2026-21858 and the 1.121.3 fix for CVE-2026-21877.
github.com (opens in a new tab)2. Workaround
Until you upgrade, restrict or disable publicly accessible webhook and form endpoints.
github.com (opens in a new tab)3. Configuration
If you cannot upgrade yet, disable the Git node and limit access for untrusted users.
github.com (opens in a new tab)
Advisories
Where to compare n8n
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why n8n matters for businesses
Many businesses use self-hosted n8n to connect AI agents with CRMs, email, and databases, so a single instance often holds API keys and OAuth tokens for many systems. A public form or webhook is enough exposure for CVE-2026-21858, which makes patching and an inventory of internet-facing automation servers urgent.
Sources for this story
- Unauthenticated File Access via Improper Webhook Request Handling (GHSA-v4pr-fm98-w9pg) (opens in a new tab)Official
n8n on GitHub · github.com
- RCE via Arbitrary File Write (GHSA-v364-rw7m-3263) (opens in a new tab)Official
n8n on GitHub · github.com
- CVE-2026-21858 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) (opens in a new tab)Press
Cyera Research Labs · cyera.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #n8n
- #workflow-automation
- #self-hosting