PT-2026-1583 · N8N · N8N

Theolelasseux · Published 2026-01-06 · Updated 2026-02-09 · CVE-2026-21877

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions 0.121.2 through 1.121.2 n8n versions 0.123.0 through 1.121.3

Description n8n, an open-source workflow automation platform, is affected by a critical authenticated Remote Code Execution (RCE) vulnerability (CVE-2026-21877). A successful exploit allows an authenticated user to execute untrusted code, potentially leading to a full compromise of the instance, impacting both self-hosted and n8n Cloud deployments. The vulnerability stems from arbitrary file write and unsafe handling of input. The Git node is specifically identified as a potential entry point for exploitation. The issue has been resolved in version 1.121.3.

Recommendations Upgrade to n8n version 1.121.3 or later. Disable the Git node if upgrading is not immediately possible. Limit access for untrusted users.

Exploit

Fix

RCE

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

BDU:2026-00916

CVE-2026-21877

GHSA-V364-RW7M-3263

Affected Products

N8N

References · 73

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21877.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263 · Vendor Advisory
• https://github.com/n8n-io/n8n/commit/f4b009d00d1f4ba9359b8e8f1c071e3d910a55f6 · Patch
• https://osv.dev/vulnerability/GHSA-v364-rw7m-3263 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21877 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21877 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/Pilipjann/status/2011409063515496855 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1q6etkp/n8n_warns_of_cvss_100_rce_vulnerability_affecting · Reddit Post
• https://twitter.com/rxerium/status/2008892499889160403 · Twitter Post
• https://twitter.com/NeuraCybSecLabs/status/2009177916865958092 · Twitter Post
• https://twitter.com/HackingRabbitS/status/2009852802936262796 · Twitter Post
• https://twitter.com/ThreatSynop/status/2008879840418521477 · Twitter Post
• https://reddit.com/r/tellerstech/comments/1qrl52r/ship_it_weekly_podcast_codebreach_in_aws · Reddit Post