[{"data":1,"prerenderedAt":185},["ShallowReactive",2],{"seo-verification":3,"blog-n8n-cve-2026-21877-critical-rce-patch-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-n8n-cve-2026-21877-critical-rce-patch-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":126,"ctaBody":127,"ctaButton":128,"ctaUrl":129,"relatedPosts":130},360,"n8n-cve-2026-21877-critical-rce-patch",{"fr":12,"en":10,"ar":13,"es":14},"n8n-cve-2026-21877-mise-a-jour-urgence","n8n-cve-2026-21877-تصحيح-ثغرة-rce","n8n-cve-2026-21877-parche-rce-critico","n8n CVE-2026-21877: patch critical RCE CVSS 9.9 now","CVE-2026-21877 enables authenticated remote code execution in n8n (CVSS 9.9). Update to ≥ 1.121.3 and apply the scheduling workaround.",10,0,false,"2026-09-18T00:00:00+00:00","2026-09-19T02:00:43+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fn8n-cve-2026-21877-mise-a-jour-urgence-poster.svg",{"categorySlug":34,"appSlug":35},"automation-workflows","n8n","The CERT Canada alert AL26-001 published on January 12, 2026 identifies three active vulnerabilities in n8n. The most critical, CVE-2026-21877 (CVSS 9.9), allows an authenticated user to execute arbitrary code on the host through the Git node. Any self-hosted instance not yet patched is exposed. This guide covers the patch procedure, post-migration checks, and the scheduling bug workaround introduced in version 2.21.7.",[38,42,53,56,84,88,91,94,123],{"type":39,"title":40,"body":41},"h2","CVE-2026-21877: why the CVSS 9.9 score is justified","The vulnerability is classified CWE-434 — unrestricted upload of a file with a dangerous type. The Git node in n8n allows, under certain conditions, an authenticated user to write an arbitrary file to the server's filesystem. An attacker can write a script to a directory executed by the n8n process, then trigger it via a workflow to achieve remote code execution.\n\nThe attack vector is network-based, with no additional user interaction required. The scope changes (scope: Changed), meaning the impact extends beyond the n8n process: confidentiality, integrity, and availability of the host are all compromised. The EPSS score reaches 5.449% (92nd percentile), indicating a high probability of active exploitation within 30 days.\n\nAlert AL26-001 from the Canadian Centre for Cyber Security also covers CVE-2026-21858 (insufficient input validation on webhooks, CVSS 10.0 per some sources) and CVE-2025-68613 (insufficient isolation of expressions in workflow configurations). All three should be addressed within the same remediation scope.",{"type":43,"title":44,"items":45},"ul","Who is exposed and in which version range",[46,47,48,49,50,51,52],"**All self-hosted n8n instances >= 0.123.0 and \u003C 1.121.3** are vulnerable to CVE-2026-21877 according to GitHub advisory GHSA-v364-rw7m-3263.","**Instances behind a reverse proxy are not protected**: the vulnerability is authenticated — a compromised account or a malicious insider is sufficient; the network perimeter does not change the exposure.","**Both Docker and npm deployments are affected**: the vector is the Git node, present in all n8n distributions regardless of installation method.","**n8n Cloud instances managed by n8n.io** received the patch with no operator action required.","**CVE-2025-68613 covers versions 0.211.0 to \u003C 1.120.4**: if you have not yet reached 1.120.4, you are exposed to both CVEs simultaneously.","**CVE-2026-21858 affects versions 1.65.0 to \u003C 1.121.0**: updating to 1.121.3 addresses all three CVEs in a single operation.","**The EPSS score of 5.449% places this CVE in the 92nd percentile** of active exploitation probability, justifying patch priority over other scheduled maintenance.",{"type":39,"title":54,"body":55},"Check your n8n instance version","Before applying the patch, identify the exact version currently running. Three methods depending on your deployment context.\n\n**Via the web interface**: log in to your instance, click the profile icon at the bottom left, then click \"About n8n\". The version is displayed in the modal window.\n\n**Via Docker**: the command `docker inspect \u003Ccontainer-name> --format '{{index .Config.Labels \"org.opencontainers.image.version\"}}'` returns the version of the running image. If the container was started from the `n8nio\u002Fn8n:latest` image, this value reflects what was current at the time of the last `docker pull`.\n\n**Via the internal API**: a `curl http:\u002F\u002Flocalhost:5678\u002Fhealthz` on the host returns `{\"status\":\"ok\"}` with the version in the headers if the instance is running.\n\nIf your version is below 1.121.3, apply the procedure below without waiting for your next maintenance window.",{"type":57,"title":58,"steps":59},"steps","Update procedure to n8n ≥ 1.121.3",[60,63,66,69,72,75,78,81],{"title":61,"body":62},"Back up your database and configuration files","Before any update, back up the current state. For a Docker Compose installation, export the SQLite or PostgreSQL database according to your configuration:\n\n```bash\n# SQLite (default path)\ncp ~\u002F.n8n\u002Fdatabase.sqlite ~\u002F.n8n\u002Fdatabase.sqlite.bak-$(date +%Y%m%d)\n\n# PostgreSQL\npg_dump -U n8n -d n8n > n8n-backup-$(date +%Y%m%d).sql\n```\n\nAlso copy your `docker-compose.yml` and `.env` file to a backup directory.",{"title":64,"body":65},"Update the docker-compose.yml file","If you are using the `n8nio\u002Fn8n:latest` image, no changes to the `docker-compose.yml` file are required. If you have pinned an explicit version (for example `n8nio\u002Fn8n:1.115.0`), update the `image` line:\n\n```yaml\nservices:\n  n8n:\n    image: n8nio\u002Fn8n:1.121.3\n```\n\nIf you want to follow the long-term stable branch, using an explicit version tag is preferable to `latest` for controlling maintenance windows.",{"title":67,"body":68},"Pull the new image","From the directory containing your `docker-compose.yml`:\n\n```bash\ndocker compose pull\n```\n\nThis command downloads only the layers of the image that have changed. On a 100 Mbit\u002Fs uplink, expect 30 to 90 seconds depending on your local cache.",{"title":70,"body":71},"Stop the current instance","```bash\ndocker compose down\n```\n\nThe shutdown is graceful: n8n waits for running executions to finish before stopping, unless you add `--timeout 0`. On a heavily loaded instance, prefer waiting for active workflows to complete before running this command, or suspend critical workflows from the interface.",{"title":73,"body":74},"Restart with the new image","```bash\ndocker compose up -d\n```\n\nDocker Compose uses the newly pulled image. Startup typically takes 10 to 20 seconds. The startup log should display version 1.121.3 or higher.",{"title":76,"body":77},"Verify the deployed version","```bash\ndocker compose logs n8n | grep -i 'version\\|n8n@'\n```\n\nOr via the internal API, from the host:\n\n```bash\ncurl -s http:\u002F\u002Flocalhost:5678\u002Fhealthz\n```\n\nConfirm that the version displayed in the interface (profile icon → About n8n) is 1.121.3 or higher before considering the update complete.",{"title":79,"body":80},"Disable the Git node if you do not use it","To neutralize the attack vector immediately without waiting for the update (for example if a maintenance window is not immediately available), disable the Git node via the environment variable:\n\n```bash\nN8N_NODES_EXCLUDE='[\"n8n-nodes-base.git\"]'\n```\n\nAdd this variable to your `.env` file and restart the instance. This is not a substitute for the update: apply the patch as soon as possible.",{"title":82,"body":83},"For an npm installation (without Docker)","```bash\nnpm update -g n8n\n# Or, if you use a process manager:\npm2 stop n8n\nnpm update -g n8n\npm2 start n8n\n```\n\nVerify the installed version with `n8n --version`. Migrating to Docker is recommended for new installations — the dedicated guide `n8n-migration-npm-docker-avant-v3` covers this path in detail.",{"type":85,"title":86,"body":87},"tip","Post-patch hardening: reducing the attack surface","The update fixes the known vulnerability, but several configurations strengthen the overall security posture of the instance.\n\n**Restrict n8n process permissions.** The container should not run as `root`. The official image uses the `node` user by default for several versions — verify that your `docker-compose.yml` does not contain `user: root`.\n\n**Enable authentication.** If your instance is exposed on the internet without authentication, add `N8N_BASIC_AUTH_ACTIVE=true` with strong credentials, or place the instance behind a proxy that requires authentication. CVE-2026-21877 is authenticated, but other unauthenticated vectors exist in the ecosystem.\n\n**Limit allowed nodes.** The `N8N_NODES_INCLUDE` variable allows only a subset of nodes. On instances dedicated to workflows that do not require Git or system access, an inclusion list reduces the surface.\n\n**Audit user accounts.** In the administration interface, verify that every active account is legitimate and that test accounts or former collaborators' accounts are disabled.\n\n**Subscribe to n8n security alerts.** The GitHub repository `n8n-io\u002Fn8n` allows subscribing to security notifications via \"Watch → Security alerts\".",{"type":39,"title":89,"body":90},"Scheduling bug after version 2.21.7: symptom and workaround","GitHub issue #31100 documents behavior reported after updating to version 2.21.7: workflows with scheduled triggers (Schedule Trigger node) stop executing at their scheduled time, without any visible error message in the logs.\n\n**Exact symptom**: workflows remain in \"active\" state in the interface, the next scheduled trigger time is displayed, but executions do not occur. The execution log shows no failed attempts — the workflows are simply not triggered. This behavior is primarily observed on queue-mode deployments (multi-worker), with PostgreSQL, but can also affect single-process instances.\n\n**What the issue indicates about the workaround**: at the time this article was published, the issue is marked \"Needs Feedback\" by the n8n team, and no official documented workaround has been published in the thread. Several operators reported that the following approaches restored scheduled executions in their environment:\n\n- Manually deactivate then reactivate each affected workflow from the interface (Active\u002FInactive toggle).\n- Restart the n8n container or service, which forces reinitialization of the internal scheduling queue.\n- On queue-mode deployments: restart the main node first, before workers.\n\nThese actions are not a fix: the problem may recur. Monitor issue #31100 for official status and the fix version.\n\n**Quickly identifying affected workflows**: in the n8n interface, filter the execution history by \"Schedule\" trigger and check for missing executions over the expected period. A workflow that should have run ten times since midnight with no trace in the log is a clear signal.",{"type":39,"title":92,"body":93},"Post-migration checks: what to verify before reopening traffic","A successful n8n update is confirmed on several axes, not just the displayed version.\n\n**Version**: the \"About n8n\" interface shows 1.121.3 or higher. The `docker inspect` command on the running image returns the same number.\n\n**Credential integrity**: n8n encrypts credentials with a key derived from `N8N_ENCRYPTION_KEY`. If this variable has not changed between versions, existing credentials are intact. Open a workflow that uses an external connection (HTTP Request, database, third-party API) and verify it runs without decryption errors.\n\n**Active workflows**: in the dashboard, verify that the number of active workflows matches the pre-update state. A workflow that was active and is no longer active after restart is a warning signal.\n\n**Scheduled executions**: if your instance uses Schedule Trigger nodes, wait for the next trigger time and confirm execution in the log. If you are on version 2.21.7 of the 2.x branch, consult the previous section on the scheduling bug.\n\n**Startup logs**: `docker compose logs n8n --tail 50` should show a clean startup without exceptions. Database connection errors or credential decryption errors appear in these first lines.\n\n**Network access**: if your instance is exposed via a reverse proxy, verify that the `\u002Fwebhook\u002F` and `\u002Fwebhook-test\u002F` routes respond correctly after the update.",{"type":95,"title":96,"headers":97,"rows":103},"comparison","n8n versions: exposure to CVEs from alert AL26-001",[98,99,100,101,102],"Version","CVE-2025-68613","CVE-2026-21858","CVE-2026-21877","Required action",[104,108,111,113,116,120],[105,106,106,106,107],"\u003C 1.120.4","Vulnerable","Update to ≥ 1.121.3",[109,110,106,106,107],"1.120.4 – 1.120.x","Fixed",[112,110,110,106,107],"1.121.0 – 1.121.2",[114,110,110,110,115],"≥ 1.121.3","No CVE action required",[117,118,118,118,119],"2.x \u003C 2.21.7","Check release notes","Check 2.x release notes",[121,118,118,118,122],"2.21.7+","Scheduling bug #31100 active",{"type":39,"title":124,"body":125},"Keeping your n8n instance up to date: the VPS approach","CVE-2026-21877 illustrates the cost of a self-hosted instance whose updates depend on an external maintenance window. On a VPS with root access, `docker compose pull && docker compose up -d` applies the patch in under ten minutes, without depending on a provider to decide the timing.\n\nThis autonomy comes with a responsibility: monitoring security advisories falls to the operator. Two sources to watch for n8n: the GitHub repository (Security tab, notifications can be enabled) and alerts from the Canadian Centre for Cyber Security or the equivalent CERT in your region.\n\nFor more on setting up a robust n8n instance — initial installation, Caddy or nginx reverse proxy, automatic TLS, and backups — see the guide \u003Ca href=\"\u002Fblog\u002Finstaller-n8n-vps\">install n8n on VPS\u003C\u002Fa>. If you are coming from an npm installation and considering migration to Docker before moving to the 2.x branch, the guide \u003Ca href=\"\u002Fblog\u002Fn8n-migration-npm-docker-avant-v3\">migration from npm to Docker before v3\u003C\u002Fa> covers this path. The patch pattern applied here is identical to the one documented for \u003Ca href=\"\u002Fblog\u002Fpostgresql-cve-2026-6471-patch-instances-self-hosted\">CVE-2026-6471 on PostgreSQL\u003C\u002Fa>.","A VPS with root access to apply your patches when you decide","On a ServOrbit VPS, `docker compose pull && docker compose up -d` runs in under ten minutes. No dependency on a provider for the maintenance window.","View Cloud VPS","\u002Fvps-cloud",[131,152,168],{"id":132,"slug":133,"slugs":134,"title":138,"excerpt":139,"readTime":140,"views":141,"isPinned":19,"publishedAt":142,"updatedAt":143,"category":144,"categories":148,"featuredImage":30,"bgImage":31,"posterImage":150,"relatedSolution":151},3,"install-n8n-on-vps-with-docker-complete-2026-guide",{"fr":135,"en":133,"ar":136,"es":137},"installer-n8n-vps","تثبيت-n8n-على-vps-مع-docker-دليل-شامل-2026","instalar-n8n-en-vps-con-docker","Install n8n on VPS with Docker: complete 2026 guide","Deploy n8n on VPS with Docker, reverse proxy and HTTPS. Covers V8 crash, 502 nginx, npm migration and execution security (GHSA-vrv8-j27g-g7cr advisory, August 2026).",12,2,"2026-06-05T00:00:00+00:00","2026-09-08T22:00:02+00:00",{"id":141,"name":145,"slug":146,"color":147,"icon":146},"Automation","automatisation","bg-brand-action\u002F10 text-brand-action",[149],{"id":141,"name":145,"slug":146,"color":147,"icon":146},"\u002Fblog\u002Fcovers\u002Finstaller-n8n-vps-poster.svg",{"categorySlug":34,"appSlug":35},{"id":153,"slug":154,"slugs":155,"title":159,"excerpt":160,"readTime":23,"views":18,"isPinned":19,"publishedAt":161,"updatedAt":162,"category":163,"categories":164,"featuredImage":30,"bgImage":31,"posterImage":166,"relatedSolution":167},344,"n8n-migration-npm-to-docker-before-v3",{"fr":156,"en":154,"ar":157,"es":158},"n8n-migration-npm-docker-avant-v3","n8n-migration-npm-to-docker-before-v3-ar","n8n-migracion-npm-docker-antes-v3","n8n 3.0: migrating from npm to Docker before October 2026","n8n 3.0 drops npm and npx support in October 2026. Detect your launch mode, export your workflows, and switch to Docker Compose with PostgreSQL before the deadline.","2026-09-09T00:00:00+00:00","2026-09-09T21:41:07+00:00",{"id":141,"name":145,"slug":146,"color":147,"icon":146},[165],{"id":141,"name":145,"slug":146,"color":147,"icon":146},"\u002Fblog\u002Fcovers\u002Fn8n-migration-npm-docker-avant-v3-poster.svg",{"categorySlug":34,"appSlug":35},{"id":169,"slug":170,"slugs":171,"title":175,"excerpt":176,"readTime":177,"views":178,"isPinned":19,"publishedAt":179,"updatedAt":180,"category":181,"categories":182,"featuredImage":30,"bgImage":31,"posterImage":184,"relatedSolution":30},339,"postgresql-cve-2026-6471-patch-self-hosted-instances",{"fr":172,"en":170,"ar":173,"es":174},"postgresql-cve-2026-6471-patch-instances-self-hosted","تصحيح-ثغرة-postgresql-cve-2026-6471-الخوادم-الذاتية","cve-2026-6471-postgresql-parchear-instancias-self-hosted","Patching PostgreSQL (CVE-2026-6471, -14669) on VPS","Two critical PostgreSQL flaws fixed on August 13, 2026: replication access to RCE and heap overflow to RCE. How to patch your self-hosted instances via apt and Docker.",7,1,"2026-09-08T00:00:00+00:00","2026-09-08T21:59:59+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[183],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fpostgresql-cve-2026-6471-patch-instances-self-hosted-poster.svg",1789783566762]