A maximum-severity security vulnerability that, if successfully exploited, could lead to authenticated remote code execution (RCE) has been reported by n8n. The vulnerability is rated 10.0 on the CVSS scoring system and has been given the CVE identifier CVE-2026-21877. November 2025 saw the release of version 1.121.3, which addressed it.

To fully fix the vulnerability, users are advised to update to this version or a later one. Administrators must limit exposure by disabling the Git node and restricting access for untrusted users if immediate patching is not feasible. The announcement coincides with n 8n fixing a number of serious issues with the platform.