Critical Vulnerability Found in n8n Workflow Automation Platform
Security researchers warn that tens of thousands of systems may be exposed due to a critical vulnerability in the widely used open-source automation platform n8n.
Critical Vulnerability Found in n8n Workflow Automation Platform
Security researchers are warning that tens of thousands of systems may be exposed to a critical vulnerability in n8n, a widely used open-source workflow automation platform deployed across enterprise environments. The flaw could leave organizations vulnerable to credential theft and broader system compromise if left unpatched.
The vulnerability, tracked as CVE-2026-21858, carries a maximum severity score of 10 and affects n8n’s standards modes. Researchers say the issue stems from a “content-type confusion” bug that allows attackers to bypass automation safeguards entirely.
High-Value Target for Enterprise and AI Workflows
According to researchers at Cyera, n8n is considered a critical component for enterprise automation and AI agent workflows, making it an especially attractive target for attackers. A successful compromise could give threat actors broad access to connected systems and services.
Cyera warned that attackers exploiting the flaw could potentially access sensitive credentials tied to platforms such as Salesforce, AWS, and OpenAI, significantly expanding the blast radius of a single intrusion.
Tens of Thousands of Instances Exposed
Internet scanning data suggests widespread exposure. As of Friday, researchers at Shadowserver identified more than 105,000 vulnerable n8n instances out of approximately 230,000 observed globally. That number has since declined to roughly 59,500, indicating some patching activity. Separately, researchers at Censys reported more than 26,000 exposed hosts, underscoring the scale of the issue.
Researchers first notified n8n about the vulnerability in November, and patches were released to customers on Nov. 18. Users are urged to upgrade immediately to version 1.121.0 to mitigate the risk.
At present, there is no evidence that the vulnerability has been actively exploited in the wild. However, researchers cautioned that the platform’s popularity and deep integrations make rapid remediation essential to reduce the likelihood of future attacks.
