n8n は任意のファイル書き込みによる RCE の脆弱性があります

The impact of CVE-2026-21877 is severe. An attacker, once authenticated, can leverage this vulnerability to execute arbitrary code on the n8n server. This grants them complete control over the system, enabling actions such as data exfiltration, malware installation, and lateral movement within the network. Given n8n's role in automating workflows and integrating with various services, a successful attack could have cascading effects, impacting connected applications and data sources. The ability to execute code directly on the server bypasses typical security controls, making this a high-risk vulnerability.

Organizations heavily reliant on n8n for workflow automation and integrations are particularly at risk. This includes businesses using n8n to connect to sensitive data sources or critical business applications. Shared hosting environments where multiple users share the same n8n instance are also at increased risk, as a compromise of one user could potentially impact others.

• nodejs / server: Monitor n8n process logs for unusual activity or unexpected code execution. Use ps aux | grep n8n to check running processes and look for suspicious commands. • generic web: Check n8n server access logs for unusual requests or patterns indicative of attempted exploitation. Look for requests targeting vulnerable endpoints. • linux / server: Use journalctl -u n8n to review n8n service logs for error messages or suspicious events related to code execution.

journalctl -u n8n -f | grep -i error

1. 2026-01-06Disclosure

   disclosure

1. 予約済み2026-01-05
2. 公開日2026-01-06
3. 更新日2026-02-03
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-21877 is to immediately upgrade to n8n version 1.121.3 or a later, patched version. If an immediate upgrade is not feasible, administrators can reduce the attack surface by disabling the Git functionality within n8n. This limits the potential attack vector. Consider implementing network segmentation to restrict access to the n8n instance. Regularly review user permissions and enforce the principle of least privilege to minimize the impact of a potential compromise. After upgrading, verify the fix by attempting to trigger the vulnerable functionality (if possible in a safe testing environment) and confirming that it is no longer exploitable.