A notable vulnerability, identified as CVE-2026-58661, has been discovered in n8n, an open-source workflow automation platform. This flaw could allow an authenticated attacker to intentionally fill up your server’s disk space, potentially causing significant disruptions to your operations. It’s important for administrators and developers using n8n to understand this risk and apply the necessary fixes promptly.
The core issue lies within n8n’s file upload feature, specifically in its data-table endpoint. When an authenticated user uploads files, the system’s built-in check for how much data can be uploaded at once doesn’t properly account for files that have already been written to a temporary storage area. This oversight means a malicious user could repeatedly send files, causing them to accumulate and eventually exhaust the available disk space on the hosting server. Although temporary files are eventually cleaned up, a determined attacker could potentially fill the disk faster than the cleanup process can remove them, leading to a denial of service for the n8n instance and possibly other services on the same host.
CVE Details
- Product: n8n
- CVE ID: CVE-2026-58661
- Published Date: July 10, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This vulnerability impacts specific versions of n8n:
- n8n versions prior to 2.28.0
- n8n 1.x branch versions prior to 1.123.58
Both the community and enterprise editions of n8n are affected if they fall within these version ranges.
Current Status
The vulnerability status is “Analyzed,” meaning it has been reviewed and detailed. Patches have been released to address this issue, making it crucial for users to update their installations.
Severity Level
CVE-2026-58661 is rated as a Medium severity vulnerability with a CVSS score of 4.3. While it doesn’t allow an attacker to gain control over your system or access sensitive data, its impact on system availability can be significant. By exhausting disk space, an attacker can effectively render the n8n application, and potentially the entire host system, unusable. This could lead to operational downtime, data processing interruptions, and require manual intervention to restore services.
Possible Solutions
To secure your n8n instance against this disk space exhaustion vulnerability, the primary recommendation is to upgrade to a patched version:
- For n8n 2.x users, upgrade to version 2.28.0 or later.
- For n8n 1.x branch users, upgrade to version 1.123.58 or later.
These updates contain the necessary fixes to correctly handle temporary file uploads and prevent unauthorized disk space consumption.
If an immediate upgrade is not feasible, consider these temporary mitigation steps:
- Restrict User Access: Limit access to your n8n instance strictly to trusted users only. This reduces the pool of potential attackers who could exploit this flaw.
- Set `uploadMaxFileSize` to a Low Value: Configure n8n to accept very small individual file uploads. While this won’t prevent multiple uploads, it will significantly slow down the rate at which disk space can be consumed.
- Monitor Disk Usage: Implement robust monitoring and alerting for disk space in the temporary upload directory used by n8n. This will help you detect and respond to unusual activity quickly.
It’s important to remember that these workarounds are not a complete fix and should only be used as a short-term measure until you can apply the official patches.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv
- https://www.vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-file-upload-endpoint
