CVE-2026-21877
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary code on n8n workflow automation platforms, leading to full system compromise. It affects both self-hosted and n8n Cloud instances running versions 0.121.2 and below. Attackers can potentially gain complete control over affected systems.
💻 Affected Systems
- n8n
📦 What is this software?
N8n by N8n
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary code, steal data, deploy ransomware, pivot to other systems, and maintain persistent access.
Likely Case
Authenticated attackers executing malicious code to steal sensitive workflow data, credentials, and potentially compromise connected systems.
If Mitigated
Limited impact with proper access controls, though authenticated users could still exploit if they have legitimate access.
🎯 Exploit Status
Requires authenticated access but exploit appears straightforward based on advisory description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.121.3
Vendor Advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263
Restart Required: Yes
Instructions:
1. Backup your n8n instance. 2. Update n8n to version 1.121.3 or later using your package manager or deployment method. 3. Restart the n8n service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Git Node
allDisable the Git node functionality that appears to be involved in the vulnerability
n8n configuration setting to disable Git node (specific command depends on deployment method)
Restrict User Access
allLimit access to only trusted users and implement principle of least privilege
Review and tighten user permissions in n8n admin interface
🧯 If You Can't Patch
- Disable Git node functionality completely
- Implement strict access controls and limit n8n access to only essential trusted users
🔍 How to Verify
Check if Vulnerable:
Check n8n version via web interface or API. If version is 0.121.2 or below, system is vulnerable.Check Version:
Check n8n web interface dashboard or use API endpoint /rest/versionVerify Fix Applied:
Verify n8n version is 1.121.3 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual Git node operations
- Suspicious code execution patterns
- Authentication from unexpected sources
Network Indicators:
- Unexpected outbound connections from n8n instance
- Suspicious payloads in n8n API traffic
SIEM Query:
source="n8n" AND (event="git_operation" OR event="code_execution")