CVE-2026-21858
Unauthenticated File Access Vulnerability in n8n Workflows
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Affected Vendors & Products
| Vendor | Product | Version |
|---|---|---|
| n8n-io | n8n | to 1.65.0 (inc) |
| n8n-io | n8n | 1.121.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in n8n, an open source workflow automation platform, allows unauthenticated remote attackers to access files on the underlying server by exploiting certain form-based workflows. It is caused by improper input validation in webhook requests, enabling attackers to bypass security boundaries and access sensitive information without any privileges or user interaction. The issue affects versions up to 1.65.0 and is fixed in version 1.121.0. [1]
How can this vulnerability impact me? :
The vulnerability can lead to exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. It results in high confidentiality and integrity loss, allowing attackers to access and potentially manipulate sensitive data without authorization. There is no impact on availability. [1]
What immediate steps should I take to mitigate this vulnerability?
Users should upgrade n8n to version 1.121.0 or later to fix the vulnerability. Until the patch is applied, temporarily restricting or disabling publicly accessible webhook and form endpoints may mitigate the risk. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated remote attackers to access sensitive information stored on the system, which could lead to exposure of personal or protected data. This exposure may result in non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding sensitive information against unauthorized access. Therefore, until the vulnerability is patched, affected systems may be at risk of violating these compliance standards. [1]