--- title: Critical Vulnerabilities in n8n Expose Users to Remote... description: A critical vulnerability (CVE-2026-21858) with a CVSS score of 10.0 has been discovered in n8n workflow automation platform, affecting approximately 100,000... canonical: https://daily.dev/posts/critical-vulnerabilities-in-n8n-expose-users-to-remote-code-execution-risks-2w4eadsdd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Vulnerabilities in n8n Expose Users to Remote Code Execution Risks | daily.dev og:description: A critical vulnerability (CVE-2026-21858) with a CVSS score of 10.0 has been discovered in n8n workflow automation platform, affecting approximately 100,000... og:url: https://daily.dev/posts/critical-vulnerabilities-in-n8n-expose-users-to-remote-code-execution-risks-2w4eadsdd og:image: https://api.daily.dev/og/posts/2w4EaDsDD.png og:image:alt: Critical Vulnerabilities in n8n Expose Users to Remote Code Execution Risks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Vulnerabilities in n8n Expose Users to Remote Code Execution Risks **[Collections](https://daily.dev/sources/collections)** · 2 min read · 4 upvotes · 0 comments ## Summary A critical vulnerability (CVE-2026-21858) with a CVSS score of 10.0 has been discovered in n8n workflow automation platform, affecting approximately 100,000 servers. The flaw allows unauthenticated attackers to gain full control through Content-Type confusion in webhook processing, enabling arbitrary file reading, credential extraction, authentication bypass, and code execution. n8n released patches within eight days, and users must upgrade to version 1.121.0 or later. Immediate mitigation steps include implementing strict IP restrictions, restricting public webhook access, and disabling vulnerable features like the Git node until patching is complete. ## Content # Critical Vulnerability in n8n Workflow Platform Demands Immediate Patching Multiple critical vulnerabilities have been recently discovered in the n8n workflow automation platform, prompting immediate action from users running self-hosted instances. The most severe vulnerability, CVE-2026-21858, has a maximum CVSS score of 10.0 and affects approximately 100,000 servers globally. This flaw allows unauthenticated attackers to take over full control of instances through a Content-Type confusion issue in webhook processing. Attackers can exploit this vulnerability to read arbitrary files, extract sensitive credentials, bypass authentication mechanisms, and execute arbitrary code. Notably, this includes the manipulation of HTTP headers and potential access to sensitive API keys, OAuth tokens, and connected services such as databases and cloud storage. This critical issue highlights the significant risks posed by n8n as it centralizes key organizational systems and data. In response to these vulnerabilities, n8n acted swiftly, releasing patches within eight days of the initial report. Users are advised to upgrade their n8n installations to version 1.121.0 or later to mitigate these threats. This version patch covers vulnerabilities in both v1.x and v2.x versions and addresses the exploit in webhook and form endpoint handling, therefore thwarting attackers' remote code execution attempts. Beyond applying patches, users should immediately implement strict IP restrictions based on the principle of least privilege and temporarily restrict access to public webhook and form endpoints until their systems are fully updated. Additionally, to secure instances further, administrators who cannot patch immediately should disable vulnerable features such as the Git node and untrusted user access. It is crucial for organizations using n8n to remain vigilant and proactive in their security measures, acknowledging that recent disclosures indicate a pattern of critical vulnerabilities. Ensuring timely updates and adopting appropriate security practices will help mitigate the risks associated with this powerful automation tool. --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#devops](https://daily.dev/tags/devops), [#vulnerability](https://daily.dev/tags/vulnerability), [#n8n](https://daily.dev/tags/n8n) [View this post on daily.dev](https://daily.dev/posts/critical-vulnerabilities-in-n8n-expose-users-to-remote-code-execution-risks-2w4eadsdd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Vulnerabilities in n8n Expose Users to Remote Code Execution Risks","url":"https://daily.dev/posts/critical-vulnerabilities-in-n8n-expose-users-to-remote-code-execution-risks-2w4eadsdd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-vulnerabilities-in-n8n-expose-users-to-remote-code-execution-risks-2w4eadsdd"},"datePublished":"2026-01-07T15:22:26.473Z","dateModified":"2026-01-15T12:10:06.564Z","description":"A critical vulnerability (CVE-2026-21858) with a CVSS score of 10.0 has been discovered in n8n workflow automation platform, affecting approximately 100,000...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d298957aadbf6eb0981d80534387a4d3?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d298957aadbf6eb0981d80534387a4d3?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-vulnerabilities-in-n8n-expose-users-to-remote-code-execution-risks-2w4eadsdd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,devops,vulnerability,n8n","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Critical Vulnerabilities in n8n Expose Users to Remote Code Execution Risks"}]} ```