n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.

This RCE in n8n has received the maximum CVSS score of 10. Immediate patching is recommended.

The version of the n8n Node.js Package installed on the remote host is prior to 1.121.3. It is, therefore, affected by a remote code execution vis expression injection vulnerability:

  - Under certain conditions, an authenticated user may be able to cause untrusted code to be     executed by the n8n service. This could result in full compromise of the affected instance. Both     self-hosted and n8n Cloud instances are impacted.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of n8n running on the remote host is after 0.123.0 and before 1.121.3. It is, therefore, affected by an authenticated arbitrary file write.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated
    attacker may be able to execute malicious code using the n8n service. This could result in full compromise
    and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3.
    Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but
    upgrading to the latest version is recommended. (CVE-2026-21877)

ID	Name	Product	Family	Severity
282600	n8n Node.js Package < 1.121.3 RCE (CVE-2026-21877)	Nessus	Misc.	critical
115104	N8n < 1.121.3 Arbitrary File Write	Web App Scanning	Artificial Intelligence	critical
436595	SCA: security update for n8n (GHSA-v364-rw7m-3263)	Tenable Cloud Security	SCA Checks	critical
436595	SCA: security update for n8n (GHSA-v364-rw7m-3263)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2026-21877

critical

Tenable Plugins

critical

critical

critical

critical