CVSS 10.0 Alert: Critical n8n Flaw CVE-2026-21877 Grants Total Control

According to GHSA-v364-rw7m-3263, n8n has a critical flaw tracked as CVE-2026-21877, rated CVSS 10.0, that potentially allows total control of both self-hosted and cloud-based instances through Remote Code Execution via Arbitrary File Write. The vulnerability enables an authenticated user to overwrite critical files and execute untrusted code on the server, effectively giving the attacker access to the entire instance.

The advisory notes this arises from the platform’s version control capabilities, with the Git node identified as the likely vector for writing malicious files; administrators are advised to disable the Git node to reduce exposure while patching. The issue is fixed in n8n version 1.121.3, and users are urged to upgrade to this version or later as a primary defence, with the alternative of restricting access to trusted users if downtime is not possible.

The article emphasises that exploitation requires authentication and highlights the risk of a single compromised account leading to full compromise of the affected instance.