n8n Warns of CVSS 10.0 RCE Vulnerability Affecting Self-Hosted and Cloud Versions

Summary: n8n disclosed CVE-2026-21877, a maximum-severity flaw rated 10.0 on CVSS that lets an authenticated user cause untrusted code to be executed by the n8n service, potentially resulting in full compromise of the affected instance. Both self-hosted deployments and n8n Cloud instances are impacted, and the issue is addressed in version 1.121.3, released in November 2025, with researcher Théo Lelasseux credited with discovering and reporting it.
What you should know: A 10.0 flaw that requires only an authenticated account turns any user you have provisioned into a potential path to full instance compromise, and the fallback for teams that cannot patch immediately is to disable the Git node and restrict access for untrusted users.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-68613 CVE-2025-68668 CVE-2026-21877
Related: ⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More Cyber Risks ·
New n8n Vulnerability (9.9 CVSS) Lets Authenticated Users Execute System Commands Cyber Risks ·
CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability Known Exploited Vulnerabilities · Mar 11, 2026