VulnSocial

CVE-2026-21877Disclosure(n8n / n8n)

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch n8n n8n systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.

n8n CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-94CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • n8n

Threat summary

  • Patch or workaround signal is available
  • 7 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 4 classified signals
  • General: 2 classified signals
  • Peaked 5d ago at 2 mentions (2026-01-28); latest day: 1
  • 7 total mentions across 6 days

Affected systems

Vendors
n8n
Products
n8n

Deep dive

Activity timeline7 mentions / 6d
01122Mentions · 2026-01-28: 2Mentions · 2026-01-29: 1Mentions · 2026-02-02: 1Mentions · 2026-02-09: 1Mentions · 2026-03-03: 1Mentions · 2026-06-06: 1Patch / Workaround · 2026-01-28: 1Technical Details · 2026-01-28: 1Technical Details · 2026-01-29: 1Technical Details · 2026-02-09: 1Technical Details · 2026-03-03: 1Technical Details · 2026-06-06: 101-2801-2902-0202-0903-0306-06
Signal classification3 categories
Disclosure
457.1%
General
228.6%
Patch
114.3%
Referenced assets9 URLs
By indicator
Classification over time
DateTotalLabels
2026-01-282
Disclosure1Patch1
2026-01-291
General1
2026-02-021
Disclosure1
2026-02-091
Disclosure1
2026-03-031
General1
2026-06-061
Disclosure1
Full discourse7 posts
  • The Shadowserver Foundation@Shadowserver
    General

    We are continuing to expand our n8n RCE vulnerability scanning - most recently adding CVE-2026-27495 (CVSS 9.4) tagging as well. You can track our various n8n scan results here for the most well known critical vulns: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=30&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-68613%2B&tag=cve-2025-68668%2B&tag=cve-2026-21858%2B&tag=cve-2026-21877%2B&tag=cve-2026-25053%2B&tag=cve-2026-25056%2B&tag=cve-2026-27495%2B&dataset=unique_ips&limit=100&group_by=tag&stacking=overlap&auto_update=on Top affected: US, Germany & France. https://t.co/mEUZ9Is6bf

    Post summary

    The post announces that the team has added CVE‑2026‑27495 to their n8n RCE scanning, provides a link to scan results, and notes the top affected regions (US, Germany, France).

    112032154.3K
    21.6K followersView on X
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-21877 - critical 🚨 n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution > n8n versions >= 0.123.0 and < 1.121.3 contain a critical authenticated remote code ex... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-21877 @pdnuclei #NucleiTemplates #cve

    Post summary

    A critical authenticated remote code execution vulnerability (CVE-2026-21877) has been disclosed for n8n versions 0.123.0 to 1.121.3; no exploits, patches, or PoC are referenced.

    02011193
    889 followersView on X
  • Komodo Cyber Security@Komodosec
    Disclosure

    #VulnerabilityReport #CriticalVulnerability CVSS 10.0 Alert: Critical n8n Flaw CVE-2026-21877 Grants Total Control https://securityonline.info/cvss-10-0-alert-critical-n8n-flaw-cve-2026-21877-grants-total-control/?utm_source=dlvr.it&utm_medium=twitter

    Post summary

    The tweet alerts readers to CVE-2026-21877, a critical flaw in n8n with a CVSS score of 10.0 that grants total control, but it does not provide a PoC, exploit, or patch information.

    1001042
    1.5K followersView on X
  • ZedBounty@ZBounty18591
    General

    ZedBounty Poll: Biggest CVE of 2026 so far? 1. CVE-2026-21877 - n8n (RCE) 2. CVE-2026-24061 - Telnet (Auth Bypass) 3. CVE-2026-21509 - MS Office (Zero-day) 4. CVE-2026-24858 - FortiOS (SSO Bypass) Vote and reply with your reasoning. 
#ZedBounty #CyberSecurity #CVE

    Post summary

    The content is a simple list of recent CVEs with brief vulnerability descriptors, lacking any exploit, PoC, or patch information, so it is classified as a general mention.

    10010185
    16 followersView on X
  • IntegSec@integ_sec
    Disclosure

    CVE-2026-21877: n8n Authenticated Remote Code Execution - What It Means for Your Business and How to Respond https://hubs.li/Q04kpl3V0

    Post summary

    The article announces CVE-2026-21877, an authenticated RCE in n8n, and outlines its potential business impact, but offers no concrete remediation, PoC, or exploitation details.

    0000034
    32 followersView on X
  • Hephaestvs@Vulcanux_
    Disclosure

    csirt_it: La Settimana Cibernetica del 01 febbraio 2026 🔹 aggiornamenti per molteplici prodotti 🔹Ivanti: rilevate due nuove vulnerabilità, di cui una di tipo zero-day ⚠️ #EPSS: 🔹Ivanti: CVE-2025-22467 🔹n8n: CVE-2026-21877 🔗https://www.acn.gov.it/portale/w/la-settimana-cibernetica-del-1-febbraio-2026-1 https://t.co/Pa72e14xe5

    Post summary

    The post announces that Ivanti and n8n have new vulnerabilities discovered, including a zero‑day, but offers no technical, exploit, or patch details.

    0000090
    607 followersView on X
  • Gergely Ignácz@igz4rd
    Patch

    IMPORTANT: Upgrade your self hosted n8n! All supported versions prior to 2.0.0 are affected. CVE-2025-68613 https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp CVE-2025-68668 https://github.com/n8n-io/n8n/security/advisories/GHSA-62r4-hw23-cc8v CVE-2026-21858 https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg CVE-2026-21877 https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263

    Post summary

    This advisory announces that all self‑hosted n8n versions before 2.0.0 are vulnerable to four CVEs and urges users to upgrade to a patched version.

    0000098
    129 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appn8nn8n-node.js-

Explore more

Back to dashboardn8n CVEsn8n vulnerabilities