CVE-2026-21877

critical

Description

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.

https://hackread.com/n8n-users-patch-full-system-takeover-vulnerability/

https://thehackernews.com/2026/01/n8n-warns-of-cvss-100-rce-vulnerability.html

https://thehackernews.com/2026/01/critical-n8n-vulnerability-cvss-100.html

https://cyberscoop.com/n8n-critical-vulnerability-massive-risk/

https://github.com/Perufitlife/n8n-security

https://github.com/CVEs-Labs/CVE-2026-21877

https://github.com/samael0x4/CVE-2026

https://github.com/rabakuku/LAB-CVES

https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263

https://github.com/n8n-io/n8n/commit/f4b009d00d1f4ba9359b8e8f1c071e3d910a55f6

Details

Source: Mitre, NVD

Published: 2026-01-08

Updated: 2026-01-20

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.9

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.10596

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability Being Monitored

Detections

Analytics