Exploit for CVE-2026-21877

## https://sploitus.com/exploit?id=416A6CC1-9B66-5015-ABD6-C85F2EB29436
# 🚨 CVE-2026-21877 — Critical RCE Vulnerability

![1767801640416](https://github.com/user-attachments/assets/7e720a3e-3a02-4558-997d-6da43fa3c966)

## 🧩 Overview

**CVE-2026-21877** is a **critical authenticated Remote Code Execution (RCE)** vulnerability affecting **n8n**, the popular open-source workflow automation platform.
If exploited, an attacker can execute **arbitrary code on the host system**, potentially leading to **full server compromise**.

---

## 📊 Severity & Scoring

| Metric                  | Value                                                     |
| ----------------------- | --------------------------------------------------------- |
| **Severity**            | 🔥 **Critical**                                           |
| **CVSS v3 Score**       | **9.9 – 10.0**                                            |
| **Attack Vector**       | Network                                                   |
| **Privileges Required** | Low (authenticated user)                                  |
| **User Interaction**    | None                                                      |
| **Impact**              | Complete loss of confidentiality, integrity, availability |

---

## 🖥️ Affected Software

### **Product**

* **n8n** (Workflow Automation Platform)

### **Affected Versions**

* Versions **≤ 0.121.2**
* Versions **> 0.123.0 and  ⚠️ Because n8n often integrates with internal systems, cloud APIs, and databases, the **blast radius can be significant**.

---

## 🛡️ Mitigation & Remediation

### ✅ **Recommended Fix (Immediate)**

* 🔄 **Upgrade to n8n version `1.121.3` or later**

### 🔧 **Temporary Workarounds**

If upgrading immediately is not possible:

* ❌ Disable the **Git node** or any nodes that perform file execution
* 🔐 Restrict workflow creation/editing to **trusted users only**
* 📉 Minimize privileges for non-admin accounts

### 🔍 **Detection & Monitoring**

* Review n8n execution logs for:

  * Unexpected command execution
  * Suspicious workflow changes
* Monitor outbound connections from the n8n host
* Watch for privilege escalation indicators on the underlying system

---

## 📌 Key Takeaways

* 🔑 Exploitation **requires authentication**, but only **low-privilege access**
* 🔥 Severity is **maximum-level critical**
* 🌐 Impacts both **cloud and self-hosted** deployments
* ⏳ No widespread public PoC yet — **patch before one appears**

---

## 🧠 Advisory Summary

> **CVE-2026-21877 allows authenticated attackers to achieve full remote code execution on vulnerable n8n instances, leading to total system compromise if left unpatched.**

---