Report · SecurityWeekAbout CVE-2026-21858Published 8 Jan 2026

Critical Vulnerability Exposes n8n Instances to Takeover Attacks

Source SecurityWeek

Authoritative record:CVE-2026-21858· Critical 10.0

Not known to be exploited · public detection template (Nuclei) · CVSS 10.0 Critical : upgrade to 1.121.0 as a priority.

Data as of 9 Jan 2026, 13:04 UTC

CVSS base score

10.0Critical

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 1.121.0

Exploitation evidence

Disclosed: evidence found.
CVE published 7 Jan 2026
Detectable: evidence found.
nuclei template: n8n Webhooks - Remote Code Execution
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

remote

What to do

Upgrade n8n and n8n-io/n8n to 1.121.0.

Affected software

Product	Affected	Fixed in
n8n-ion8n	Affected >=1.65.0 <1.121.0	Fixed in 1.121.0
npmn8n-io/n8n`pkg:npm/n8n-io/n8n`Other threats	Affected <1.121.0 >=1.65.0	Fixed in 1.121.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Immediate mitigation steps include isolating n8n instances from public networks and restricting access via firewalls or VPNs. Organizations should monitor network traffic for unusual activity targeting n8n endpoints and implement strict access controls. Employing Web Application Firewalls (WAFs) to detect and block malicious payloads targeting this vulnerability can provide interim protection. Regularly auditing and hardening the configuration of n8n deployments, including disabling unnecessary features and enforcing least privilege principles, will reduce attack surface. Backup critical workflow data and configurations to enable rapid recovery in case of compromise. Finally, integrating threat intelligence feeds and incident response plans specific to automation platform vulnerabilities will enhance preparedness.

Description

Tracked as CVE-2026-21858 (CVSS score 10), the bug enables remote code execution without authentication. The post Critical Vulnerability Exposes n8n Instances to Takeover Attacks appeared first on SecurityWeek .

Impact

For European organizations, the impact of this vulnerability is substantial. Many enterprises and public sector entities in Europe utilize automation platforms like n8n to streamline operations, integrate cloud services, and manage data flows. A successful attack could lead to unauthorized access to sensitive data, disruption of business processes, and potential regulatory non-compliance under GDPR due to data breaches. The ability to execute code remotely without authentication means attackers can bypass perimeter defenses and gain persistent access. This risk is heightened in sectors such as finance, healthcare, manufacturing, and government, where automation tools are deeply embedded. Additionally, the disruption of automated workflows could cause operational downtime, financial losses, and reputational damage. The threat also extends to supply chain security, as compromised n8n instances could be used to attack connected systems or partners.

Summary

The vulnerability CVE-2026-21858 is a critical security flaw in n8n, an open-source workflow automation tool widely used to connect various services and automate tasks. This vulnerability allows remote code execution (RCE) without any authentication, meaning an attacker can execute arbitrary code on the server hosting n8n simply by sending crafted requests. The lack of authentication and user interaction requirements significantly lowers the barrier for exploitation. RCE vulnerabilities are among the most severe because they can lead to full system compromise, enabling attackers to steal data, disrupt services, or pivot to other network resources. Although no exploits have been reported in the wild yet, the CVSS score of 10 underscores the extreme risk. The absence of affected versions and patch links in the provided data suggests that the vulnerability is either newly disclosed or under active remediation. n8n's role in automating business-critical workflows means that exploitation could disrupt numerous integrated services, causing cascading operational failures. Attackers could leverage this flaw to implant malware, exfiltrate sensitive information, or manipulate automated processes for financial or espionage gains.

References

securityweek.com/critical-vulnerability-exposes-n8n-instances-to-takeover-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jan 2026, 13:19 UTC

Public exploits and detectiona Nuclei detection template

References

Community reviews

Related threats