n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.

This RCE in n8n has received the maximum CVSS score of 10. Immediate patching is recommended.

The version of the n8n Node.js Package installed on the remote host is prior to 1.121.0. It is, therefore, affected by an improper access control vulnerability:

  - A vulnerability in n8n allows an attacker to access files on the underlying server     through execution of certain form-based workflows. A vulnerable workflow could grant     access to an unauthenticated remote attacker. This could result in exposure of sensitive     information stored on the system and may enable further compromise depending on deployment     configuration and workflow usage.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of n8n running on the remote host is before 1.121.0. It is, therefore, affected by an unauthentcated file access vulnerability which can leads to remote code execution.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable
    an attacker to access files on the underlying server through execution of certain form-based workflows. A
    vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of
    sensitive information stored on the system and may enable further compromise depending on deployment
    configuration and workflow usage. This issue is fixed in version 1.121.0. (CVE-2026-21858)

ID	Name	Product	Family	Type	Severity
282598	n8n Node.js Package 1.65.0 < 1.121.0 Improper Access Control (Ni8Mare)	Nessus	Misc.	Local	critical
115105	N8n < 1.121.0 Remote Code Execution (Ni8mare)	Web App Scanning	Artificial Intelligence	Version Based	critical
436610	SCA: security update for n8n (GHSA-v4pr-fm98-w9pg)	Tenable Cloud Security	SCA Checks	Local	critical
436610	SCA: security update for n8n (GHSA-v4pr-fm98-w9pg)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-21858

critical

Tenable Plugins

critical

critical

critical

critical