A critical security vulnerability has been discovered in n8n, the popular workflow automation platform, allowing authenticated attackers to execute arbitrary code on affected instances.
Tracked as CVE-2026-21877 with a CVSS score of 9.9, this vulnerability impacts both self-hosted and n8n Cloud deployments and requires immediate remediation.
The vulnerability stems from improper input validation in the Git node functionality, enabling attackers with low-level authenticated access to inject and execute untrusted code.
Security researcher theolelasseux identified the flaw, which exploits weaknesses in file-upload handling and command-injection vectors.
Given n8n’s integration with sensitive internal APIs, databases, and third-party services, successful exploitation could result in complete instance compromise, credential theft, and lateral movement across the network.
The issue is classified as Authenticated Remote Code Execution, exploiting CWE-434 (Unrestricted Upload of File with Dangerous Type) via command injection.
The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates the attack is network-accessible with low complexity, requires only low-level privileges, involves no user interaction, and has a changed scope, meaning compromise extends beyond the application to the underlying host system.
The vulnerability specifically targets how n8n processes authenticated requests to certain workflow nodes.
Attackers leveraging compromised user accounts or those with legitimate but untrusted access could weaponize the Git node to execute shell commands with application-level privileges.
| Metric | Details |
|---|---|
| CVE Identifier | CVE-2026-21877 |
| Severity Rating | Critical |
| CVSS v3.1 Score | 9.9 |
Organizations must prioritize immediate patching. The n8n team has released version 1.121.3, which sanitizes vulnerable inputs and restricts the execution capabilities of affected nodes.
Self-hosted users, particularly those exposing instances to the internet, face the highest risk and should upgrade without delay.
For organizations unable to patch immediately, administrators should implement access controls restricting instance access to trusted users only.
As a temporary workaround, disabling Git node functionality can reduce the attack surface until full remediation is complete.
Additionally, administrators should review instance logs for suspicious activity involving the Git node or unexpected command executions.
n8n is a free, open-source workflow automation platform that enables users to connect independent services via APIs.
The tool is widely deployed for technical process automation, data synchronization, and backend development.
Its integration capabilities make it attractive for enterprise automation, but also create potential security risks when vulnerabilities remain unpatched.
The discovery of CVE-2026-21877 underscores the importance of rapid vulnerability response for automation platforms that are critical infrastructure components.
Organizations relying on n8n for business-critical workflows should immediately update their instances to version 1.121.3 or later.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.
%20(1)%20(1).webp?fit=1600,900&ssl=1&description=Tracked as CVE-2026-21877 with a CVSS score of 9.9, this vulnerability impacts both self-hosted and n8n Cloud deployments and requires immediate remediation.){kind=link}