Loading story…
German security advisories from dCERT reported multiple vulnerabilities affecting n8n, the workflow automation and orchestration platform. The notices identify separate advisories, 2026-0860 and 2026-1228, indicating that more than one set of security issues has been documented for the product.
The available advisory metadata does not include technical synopses, affected versions, or mitigation details, but the repeated disclosures signal an ongoing security concern for organizations using n8n. Security teams should review the referenced dCERT advisories, determine whether deployed n8n instances are affected, and prioritize vendor patches or other recommended mitigations as details become available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
dCERT issued advisory 2026-1560 for an n8n vulnerability that allows information disclosure. The reference indicates a new advisory publication but provides no further technical details or remediation information.
dCERT issued a third advisory, 2026-1490, covering multiple vulnerabilities affecting n8n. The reference indicates a new advisory publication but does not provide further technical details or remediation information.
dCERT issued a second advisory, 2026-1228, for multiple vulnerabilities in n8n. The reference indicates a new advisory publication but does not include additional specifics about the flaws or remediation.
dCERT issued advisory 2026-0860 covering multiple vulnerabilities affecting n8n. No further technical details are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported **critical vulnerabilities in the n8n low-code workflow automation platform** that can enable **host-level compromise**. The issues include **CVE-2026-1470 (CVSS 9.9)** and **CVE-2026-0863 (CVSS 8.5)**, described as allowing attackers to **bypass security controls**, achieve **arbitrary code execution**, and potentially obtain **full control of n8n services**, with downstream exposure of **credentials, API keys, and other sensitive data**. Impact spans **cloud deployments** as well as **self-hosted instances** that have not been patched. Given n8n’s common use to integrate SaaS services and increasingly to orchestrate **LLM-enabled business workflows**, successful exploitation could provide broad access to connected systems and secrets stored in workflows. Coverage also noted the disclosures follow an earlier, separate critical n8n issue reported in late 2025, reinforcing the need for tighter vulnerability management around automation/orchestration tooling. Organizations were urged to **upgrade to patched versions** and review hardening controls for n8n deployments, particularly where the platform has access to high-privilege tokens and production integrations.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability, identified as CVE-2026-21877 and rated CVSS 10.0, was disclosed in the open-source workflow automation platform n8n. The flaw allows authenticated users to execute arbitrary code on affected instances, potentially leading to full system compromise. Both self-hosted and n8n Cloud deployments are impacted, specifically versions from 0.123.0 up to but not including 1.121.3. The vulnerability was discovered by security researcher Théo Lelasseux and has been addressed in version 1.121.3, released in November 2025. Administrators are strongly advised to upgrade immediately or, if patching is not possible, to disable the Git node and restrict access for untrusted users to mitigate risk. The disclosure follows a series of critical vulnerabilities in n8n, highlighting ongoing security challenges for the platform. The Canadian Centre for Cyber Security and other sources have issued advisories urging prompt action to apply the necessary updates. The vulnerability underscores the importance of timely patch management and access control for workflow automation tools, especially those exposed to untrusted users or the internet.
Jun 29, 2026
Multiple critical vulnerabilities have been disclosed in the open-source workflow automation platform n8n, exposing both self-hosted and cloud deployments to severe security risks. The most severe flaw, tracked as CVE-2026-21877, allows authenticated attackers to execute arbitrary code on affected instances, potentially granting full control over the system. This vulnerability impacts a wide range of n8n installations, and while patches have been released, unpatched systems remain at risk. Another critical flaw, CVE-2026-21858, has also been highlighted, with reports indicating that over 100,000 servers could be exposed due to the public release of exploit code. Security researchers have emphasized the urgency of applying available patches to mitigate these threats, as the public availability of exploits significantly increases the likelihood of widespread attacks. Organizations using n8n are strongly advised to update their deployments immediately and review their exposure, especially if instances are accessible from the internet. The vulnerabilities underscore the importance of timely patch management and monitoring for signs of compromise in automation and integration platforms.
Jun 29, 2026