{"action":"Upgrade n8n to 1.121.0 or later.","affected":[{"fixed":"1.121.0","introduced":"1.65.0"}],"component":"n8n","cve_ids":["CVE-2026-21858"],"ecosystem":"npm","epss":0.78188,"exploited":false,"fixed_versions":["1.121.0"],"ghsa_id":"GHSA-v4pr-fm98-w9pg","id":"tcs_01M5KGAQK4BPR927F7SRQXXQ47","modified_at":"2026-02-03T03:01:21.697680Z","published_at":"2026-01-07T19:20:19Z","references":["https://osv.dev/vulnerability/GHSA-v4pr-fm98-w9pg","https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg","https://nvd.nist.gov/vuln/detail/CVE-2026-21858","https://github.com/n8n-io/n8n","https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-v4pr-fm98-w9pg","url":"https://osv.dev/vulnerability/GHSA-v4pr-fm98-w9pg"}],"summary":"n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling"}