CVE-2026-21877
Criticaln8n Vulnerable to RCE via Arbitrary File Write
Published Jan 6, 2026 · Updated Aug 12, 2026 · Also known as GHSA-v364-rw7m-3263
Key Facts
Patch in the next maintenance window- CVE-2026-21877 is a critical-severity vulnerability (CVSS 9.9 v3.1) affecting N8n.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 5.4% probability of exploitation in the next 30 days.
- Fixed versions are available, including N8n 1.121.3.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
5.4%
Higher than 92.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-21877 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| N8nN8n | >= 0.123.0, >= < 1.121.3 | 1.121.3 |
Patched Releases
N8n
1.121.3
Timeline
Publicly disclosed
Jan 6, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21877.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-21877
- articlehttps://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263
- otherhttps://github.com/n8n-io/n8n
FAQ
Common Questions.
n8n is an open source workflow automation platform.
Affected: N8n versions >= 0.123.0, >= < 1.121.3. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including N8n 1.121.3.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-21877 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo