CVE-2026-2185810.0CriticalCWE-20
n8n-io n8n vulnerability
n8n-io · n8n
Not in CISA KEVVendor fix available
78.2%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
Coverage3 articles · 3 outlets
First in our coverage: The Hacker News, 28 Jan.
Quiet for 13 weekslast report 30 Jul3 articles3 outlets
- Wed 28 Jan, 13:30 UTC. The Hacker News, first report. Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution.
- Thu 29 Jan, 22:36 UTC. Dark Reading, its first report on the story. More Critical Flaws on n8n Could Compromise Customer Security.
- Thu 30 Jul, 10:32 UTC. Unit 42, its first report on the story. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks.
- Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous CyberattacksUnit 42 · mentions it in passing
- More Critical Flaws on n8n Could Compromise Customer SecurityDark Reading · mentions it in passing
- Two High-Severity n8n Flaws Allow Authenticated Remote Code ExecutionThe Hacker News · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.