InfoSecBulletin Cybersecurity for mankind
A total of 35 unique IP addresses have been identified exploitable via n8n instances (CVE: 2026-21858). BGD e-GOV CIRT advisory said, these IP address seems to be demonstrating active exploitation activity, indicating real-world targeting and compromise of vulnerable deployments.
Affected versons:
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
• n8n self-hosted instances running versions 1.65.0 to below 1.120.0, This issue is fixed in
version 1.121.0 and later.
• Deployments accessible via the internet, especially those using webhooks for integrations
(e.g., with Slack, email services, or custom APIs).
Vulnerability Overview: CVE-2026-21858:
Product: n8n (Open-Source Workflow Automation Platform)
Severity: Critical (CVSS v3.1 Score: 10.0)
Affected Versions: All n8n versions prior to 1.121.0
Attack Vector: Network-based; no authentication required
Impact:
Exploiting this vulnerability allows an unauthenticated attacker to execute code remotely, access files, and steal sensitive information. In severe cases, it can compromise the entire system and enable further attacks on the network, greatly threatening infrastructure security.
BGD e-GOV CIRT urges to upgrade all n8n instances to v1.121.0 or later immediatly.
Related news:
BTRC NEIR face 2.4 million bot traffic in a minute
How Millions of Illegal IMEI Phones Infiltrated Bangladesh’s Networks
