CVE-2026-21858
📋 TL;DR
This vulnerability in n8n workflow automation platform allows unauthenticated remote attackers to execute certain form-based workflows that can access files on the underlying server. Attackers can read sensitive information stored on the system and potentially achieve further compromise depending on deployment configuration. Affected systems are n8n versions 1.65.0 through 1.120.x.
💻 Affected Systems
- n8n
📦 What is this software?
N8n by N8n
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data exfiltration, lateral movement, and complete system takeover
Likely Case
Unauthenticated file read access exposing configuration files, credentials, and sensitive data
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access
🎯 Exploit Status
Public research demonstrates exploitation techniques; attack requires specific workflow configurations but is straightforward once identified
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.121.0
Vendor Advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg
Restart Required: Yes
Instructions:
1. Backup your n8n instance and workflows. 2. Update n8n to version 1.121.0 or later using your package manager. 3. Restart the n8n service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable form-based workflows
allTemporarily disable or remove form-based workflows that could be exploited
Network isolation
linuxRestrict network access to n8n instance using firewall rules
iptables -A INPUT -p tcp --dport 5678 -j DROP
🧯 If You Can't Patch
- Isolate n8n instance behind authentication proxy or VPN
- Implement strict network segmentation and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check n8n version; if between 1.65.0 and 1.120.x inclusive, you are vulnerableCheck Version:
n8n --version or check package manager versionVerify Fix Applied:
Verify n8n version is 1.121.0 or higher and test that form-based workflows no longer allow unauthorized file access📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from n8n processes
- Form workflow executions from unexpected IP addresses
Network Indicators:
- HTTP requests to form endpoints from unauthorized sources
- Unusual outbound data transfers
SIEM Query:
source="n8n" AND (event="file_access" OR event="workflow_execution") AND src_ip NOT IN [allowed_ips]