CVE-2026-21858 is a critical vulnerability affecting n8n workflow automation platform versions 1.65.0 through 1.120.0. It allows an unauthenticated remote attacker to access files on the underlying server via specially crafted form-based workflows, potentially leading to sensitive information exposure and further system compromise. With a CVSS score of 10.0, this flaw is easily exploitable over the network with no user interaction, enabling high impact to confidentiality and integrity. While not officially listed as actively exploited in KEV, public exploit code (Nuclei templates) and extensive community discussion, including reports of full RCE, indicate a high likelihood of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.65.0, < 1.121.0CPE matchmatch criteria | cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.