n8n Warns of CVSS 10.0 RCE Vulnerability Affecting Self-Hosted and Cloud Versions

n8n has warned of a maximum-severity security flaw that could enable authenticated remote code execution (RCE) if exploited, tracked as CVE-2026-21877 and rated 10.0 on the CVSS scale. According to n8n, under certain conditions an authenticated user may cause untrusted code to be executed by the n8n service, potentially resulting in a full compromise of the affected instance.

The issue affects both self-hosted deployments and n8n Cloud, with vulnerable versions ranging from >= 0.123.0 to < 1.121.3, and it has been addressed in version 1.121.3, released in November 2025. Security researcher Théo Lelasseux is credited with discovering and reporting the flaw. Administrators are advised to upgrade to 1.121.3 or later, and if immediate patching is not possible, to limit exposure by disabling the Git node and restricting access for untrusted users.

This disclosure comes as n8n has earlier addressed other critical flaws with CVSS scores around 9.9 that could lead to code execution under certain conditions.