Description
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| n8n-io | n8n | < 1.121.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
monkeontheroof/cve-2026-21877-rce ★ 0 · Apr 26, 2026
-
CVEs-Labs/CVE-2026-21877 ★ 0 · Apr 22, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution http/cves/2026/CVE-2026-21877.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | n8n | >= 0.123.0, < 1.121.3 | 1.121.3 | GHSA-v364-rw7m-3263 |
Advisories 1
- WID-SEC-2026-0025 n8n: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jan 6, 2026