CVE-2026-21858N8n N8n Improper Input Validation
NVDCVSS scored by security-advisories@github.com
Vulnerability Summary
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
CVSS v3.1 Base Metrics — Score 10.0 (CRITICAL)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NAttack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
Affected & Patched Versions
- N8n N8n >= 1.65.0 and < 1.121.0
- N8n N8n 1.121.0
What to do
Prioritize this fix. Exploit code is public, so attacks can follow quickly.
- Check whether you run N8n N8n and which version.
- Update to a patched version listed above, then confirm the new version.
- Review logs and exposed services for signs of earlier compromise.
Timeline
- Jan 8, 2026Published
- Jan 16, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new N8n N8n CVEsYou are reading CVE-2026-21858. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
External References
Data last checked: Nov 14, 2026 13:06 UTC