Critical vulnerability in n8n allows unauthenticated attack. Fix already available

What happened

In the open-source automation platform n8n a critical vulnerability rated CVSS 10.0, designated CVE-2026-21858, has been discovered. The flaw can allow a remote attack without authentication, particularly affecting certain form-based workflows and webhooks.

Depending on the specific deployment, an attacker may gain access to files on the server, which opens the door to further compromise of the system.

Why it matters

n8n is often deployed in practice as a central automation tool. It connects internal systems, cloud services, databases, or APIs and commonly handles sensitive data — for example access tokens, authentication keys, or database credentials.

Even relatively limited access to files can therefore pose a serious security risk, as it enables follow-on attacks against other parts of the infrastructure.

Who is affected

The vulnerability affects n8n versions lower than 1.121.0. According to the security company Cyera, which discovered the bug, as many as around 100 000 instances could be exposed on the internet. However, this is the researchers' estimate, not an officially confirmed number.

How the attack works (simplified)

The root of the problem lies in how n8n processes data received via webhooks and forms. An attacker can send a specially crafted request that the system begins to handle as if it were dealing with files — even though no actual file upload took place.

The consequence can be reading arbitrary files on the server and, in some scenarios, further compromise of the entire instance, depending on the configuration of workflows and integrations.

There is a fix

The good news is that a fix is already available. The vulnerability is fixed in n8n 1.121.0 and later.

The developers also warn that there is no official full workaround. As a temporary measure, they recommend restricting or disabling publicly accessible webhooks and form endpoints until the update is deployed.

Summary

The vulnerability CVE-2026-21858 demonstrates how risky bugs in tools that sit at the center of automation and data handling can be. If you use n8n, delaying the update significantly increases the risk of compromise — not only of the platform itself, but also of the systems that depend on it.