Code Execution Vulnerability in n8n Workflow Automation Platform by n8n
CVE-2026-21877

10CRITICAL

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
8 January 2026

What is CVE-2026-21877?

The n8n workflow automation platform is susceptible to a vulnerability where an authenticated attacker may exploit the service to execute arbitrary code. This risk applies to instances of n8n running version 0.121.2 and earlier, potentially leading to full system compromise, affecting both self-hosted setups and n8n Cloud environments. To mitigate exposure, administrators are advised to disable the Git node and restrict access for untrusted users, while upgrading to version 1.121.3 is strongly recommended to ensure safety and security.

Affected Version(s)

n8n < 1.121.3

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-v3...
x_refsource_CONFIRM
https://github.com/n8n-io/n8n/commit/f4b009d00d1f4ba9359b...
x_refsource_MISC

EPSS Score

14% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.