Summary
| Item | Details |
| Vulnerability Name |
n8n Remote Code Execution (CVE-2026-21858) |
| Released on |
January 09, 2026 |
| Affected Component |
n8n |
| Affected Version |
n8n < 1.121.0 |
| Vulnerability Type |
Code execution |
| Exploitation Condition |
1.User authentication: not required. 2.Precondition: default configurations. 3.Trigger mode: remote. |
| Impact |
Exploitation difficulty: easy. Unauthorized attackers can exploit this vulnerability to execute arbitrary code. Severity: critical. This vulnerability can result in remote code execution. |
| Official Solution |
Available |
About the Vulnerability
Component Introduction
n8n is an open-source workflow automation platform that allows users to connect various applications, services, and APIs by dragging nodes on a visual interface. It enables users to construct complex automated processes without the need for extensive coding. The letter "n" in its name stands for "numerous", which indicates that n8n can connect countless tools for flexible integration.
Vulnerability Description
On January 09, 2026, Sangfor FarSight Labs received notification of the remote code execution vulnerability in n8n (CVE-2026-21858), classified as critical in threat level.
Specifically, n8n contains a remote code execution vulnerability, which originates from a "Content-Type confusion" logic error in processing HTTP requests. The prepareFormReturnItem function on the Form Webhook node blindly trusts the content of req.body.files without validating the request type. This enables unauthenticated attackers to craft specific JSON requests to read arbitrary files. Consequently, the attackers can steal credentials and encryption keys from databases and configuration files, forge administrator session cookies to log in to the system, and ultimately gain control of the server through arbitrary command execution by creating workflows containing command execution nodes.
Affected Versions
The following n8n versions are affected:
n8n < 1.121.0
Solutions
Remediation Solutions
Official Solutions
The latest version has been officially released to fix the vulnerability. Affected users are advised to update n8n to the latest version.
Download link: https://github.com/n8n-io/n8n/releases
Temporary Solutions
Sangfor Solutions
Proactive Vulnerability Detection
The following Sangfor services can proactively detect CVE-2026-21858 vulnerabilities and quickly identify vulnerability risks in batches in business scenarios:
- Athena Managed Detection and Response (MDR): The corresponding detection solution will be released on March 30, 2026. The rule ID is SF-2026-01001.
- Athena Extended Detection and Response (XDR): The corresponding detection solution will be released on January 12, 2026. The rule ID is SF-2026-00431.
Vulnerability Monitoring
The following Sangfor services support CVE-2026-21858 vulnerability monitoring, and can quickly identify affected assets and the impact scope in business scenarios in real time through traffic collection:
- Athena Network Detection and Response (NDR): The corresponding monitoring solution will be released on January 12, 2026. The rule ID is 11228001.
- Athena MDR: The corresponding monitoring solution will be released on January 12, 2026. The rule ID is 11228001. In this case, make sure that Athena MDR is integrated with Athena NDR.
- Athena XDR: The corresponding monitoring solution will be released on January 12, 2026. The rule ID is 11228001.
- Sangfor Traffic Monitoring GPT: Sangfor Traffic Monitoring GPT can detect attacks and threats targeting this vulnerability based on its understanding of attacks and code, without the need to configure rules.
Vulnerability Prevention
The following Sangfor services can effectively block CVE-2026-21858 exploits:
- Athena Next-Generation Firewall (NGFW): The corresponding prevention solution will be released on January 12, 2026. The rule ID is 11228001.
- Sangfor Web Application Firewall (WAF): The corresponding prevention solution will be released on January 12, 2026. The rule ID is 11228001.
- Athena MDR: The corresponding prevention solution will be released on January 12, 2026. The rule ID is 11228001. In this case, make sure that Athena MDR is integrated with Athena NGFW.
- Athena XDR: The corresponding prevention solution will be released on January 12, 2026. The rule ID is 11228001. In this case, make sure that Athena XDR is integrated with Athena NGFW.
Timeline
On January 09, 2026, Sangfor FarSight Labs received notification of the remote code execution vulnerability in n8n (CVE-2026-21858).
On January 09, 2026, Sangfor FarSight Labs released a vulnerability alert.
Reference
https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg
Learn More
Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.
