CVE-2026-21877: 
NixOS vulnerability analysis and mitigation

CVE-2026-21877 is a critical authenticated Remote Code Execution (RCE) vulnerability in the n8n workflow automation platform, tracked under GitHub Advisory GHSA-v364-rw7m-3263 and titled "RCE via Arbitrary File Write." It affects n8n versions from 0.123.0 up to (but not including) 1.121.3, impacting both self-hosted and n8n Cloud deployments. The vulnerability was published on January 6, 2026, by researcher theolelasseux, with NVD publication on January 8, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, n8n Security Advisory).

The root cause is improper validation of file paths in n8n's Git node, which allows an authenticated user to write arbitrary files to the server filesystem (CWE-434: Unrestricted Upload of File with Dangerous Type) and subsequently trigger code injection (CWE-94: Improper Control of Generation of Code). Specifically, the Git node did not check whether a user-supplied repositoryPath parameter pointed to a blocked or sensitive location, enabling an attacker to write malicious content — such as executable scripts or configuration overrides — to arbitrary paths accessible by the n8n service process. The fix, applied in commit f4b009d, adds an isFilePathBlocked check to the Git node before processing the repository path parameter (Patch Commit, GitHub Advisory). Exploitation requires only low-privilege authenticated access with no user interaction, and the scope change (S:C) indicates impact can extend beyond the n8n application itself (Rapid7 Blog).

Successful exploitation results in full compromise of the affected n8n instance, with high impact on confidentiality, integrity, and availability. An attacker can execute arbitrary code as the n8n service account, access all data processed by workflows (including credentials, API keys, and sensitive automation data), manipulate or destroy workflows, and potentially pivot to connected systems and services integrated with n8n. The changed scope means the impact can extend beyond the n8n process to the underlying host and any systems reachable from it (n8n Security Advisory, Rapid7 Blog, Field Effect).

Exploitation requires only a low-privilege authenticated account and no user interaction, making it accessible to any user with access to an n8n instance. Exploitation has been reported in the wild, with leansecurity.com.au among sources noting active exploitation activity (Feedly). A public PoC repository (Ashwesker/Ashwesker-CVE-2026-21877) appeared on GitHub shortly after disclosure, and Nuclei templates for detection were added to the ProjectDiscovery repository. The EPSS score is approximately 5.9% (91st percentile) per the GitHub Advisory Database, indicating elevated exploitation probability (GitHub Advisory). The Shadowserver Foundation reported scanning activity targeting exposed n8n instances, with over 24,700–59,000 potentially vulnerable instances identified publicly (VulnCheck Blog). As of the time of reporting, CVE-2026-21877 does not appear in the CISA KEV catalog, though VulnCheck has advocated for its inclusion.

1. Reconnaissance: Identify internet-facing n8n instances (versions 0.123.0–1.121.2) using tools like Shodan, Censys, or ProjectDiscovery's Nuclei templates targeting n8n login pages or API endpoints.
2. Authentication: Obtain or create a low-privilege authenticated account on the target n8n instance (e.g., via self-registration if enabled, phishing, or credential stuffing).
3. Access the Git Node: Navigate to the n8n workflow editor and create or modify a workflow that includes the Git node, which allows specifying a repositoryPath parameter.
4. Supply a malicious repository path: Set the repositoryPath parameter to a sensitive or writable location on the server filesystem (e.g., a path where n8n loads configuration, plugins, or executable scripts) rather than a legitimate Git repository directory.
5. Trigger arbitrary file write: Execute the workflow, causing n8n to write attacker-controlled content (e.g., a malicious script or configuration file) to the specified path via the Git node's file operations, bypassing the missing path validation.
6. Achieve code execution: Trigger execution of the written file through a subsequent workflow action, service restart, or by writing to a location that is automatically loaded/executed by the n8n runtime or the underlying OS, resulting in RCE as the n8n service account.
7. Post-exploitation: Establish persistence, exfiltrate credentials stored in n8n, or pivot to connected services and APIs integrated with the automation platform (n8n Security Advisory, Patch Commit, Rapid7 Blog).

• Network: Unusual outbound connections from the n8n server to unknown external IPs; scanning activity targeting n8n login or API endpoints from external sources; unexpected DNS lookups from the n8n process.
• Logs: n8n workflow execution logs showing Git node executions with non-standard or sensitive repositoryPath values (e.g., paths outside expected data directories); repeated authentication attempts or new account creation in n8n audit logs; workflow executions by low-privilege users accessing Git node functionality.
• File System: Unexpected files written to n8n installation directories, configuration paths, or system directories by the n8n service account; new or modified scripts, cron jobs, or startup files owned by the n8n process user; presence of web shells or reverse shell scripts in n8n-accessible directories.
• Process: Unusual child processes spawned by the n8n Node.js process (e.g., bash, sh, curl, wget, python, nc); unexpected network listeners opened by the n8n service account.
• Artifacts: Presence of the GitHub PoC repository files (Ashwesker-CVE-2026-21877) or Nuclei template outputs on attacker-controlled infrastructure; n8n workflows containing Git nodes with suspicious repository paths (n8n Security Advisory, Rapid7 Blog).

The primary remediation is to upgrade n8n to version 1.121.3 or later, which contains the fix that validates repository paths in the Git node before processing (n8n Security Advisory). For organizations unable to upgrade immediately, the official workaround is to disable the Git node in n8n and restrict access for untrusted users — n8n's documentation on blocking access to nodes provides guidance for this configuration. Additional hardening steps include: restricting network access to n8n instances to authorized users only, implementing network segmentation to limit what n8n can reach, reviewing and auditing existing workflows for suspicious Git node usage, and monitoring for unusual authentication or workflow execution activity (GitHub Advisory, Canadian CCCS Advisory).

The vulnerability received significant media and community attention, with The Hacker News, CyberScoop, CSO Online, and SentinelOne all covering it shortly after disclosure (The Hacker News, CyberScoop). Government CERTs including Canada's CCCS, Belgium's CCB, and Australia's WA SOC issued advisories urging immediate patching (Canadian CCCS). Rapid7 and LevelBlue (SpiderLabs) published detailed technical analyses, with Rapid7 naming the vulnerability cluster "ni8mare" (Rapid7 Blog, LevelBlue Blog). The Shadowserver Foundation reported active scanning of exposed n8n instances, and VulnCheck publicly called for the CVE to be added to the CISA KEV catalog given evidence of exploitation (VulnCheck Blog). Community discussion on Reddit and the n8n forums reflected concern about the sudden advisory publication and questions about versioning (n8n Community).