CVE-2026-58661

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv	Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-file-upload-endpoint	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::

History

24 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) n8n antes de 2.28.0 (y antes de 1.123.58 en la rama 1.x) contiene una vulnerabilidad de agotamiento de espacio en disco en el endpoint de carga de archivos de la tabla de datos. La verificación de cuota por solicitud no tiene en cuenta los archivos ya escritos en el directorio temporal compartido, permitiendo a un usuario autenticado cargar repetidamente archivos que se acumulan en el disco hasta que se ejecuta la limpieza periódica, agotando potencialmente el espacio en disco disponible en el host.

Information

Published : 2026-07-10 15:16

Updated : 2026-10-29 19:17

NVD link : CVE-2026-58661

Mitre link : CVE-2026-58661

CVE.ORG link : CVE-2026-58661

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-58661", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58661", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T16:43:17.458913Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "n8n", "product": "n8n", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.28.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.28.0", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "1.123.58", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.58", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}]}], "published": "2026-07-10T15:16:47.987", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv", "tags": ["Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-file-upload-endpoint", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host."}, {"lang": "es", "value": "n8n antes de 2.28.0 (y antes de 1.123.58 en la rama 1.x) contiene una vulnerabilidad de agotamiento de espacio en disco en el endpoint de carga de archivos de la tabla de datos. La verificaci\u00f3n de cuota por solicitud no tiene en cuenta los archivos ya escritos en el directorio temporal compartido, permitiendo a un usuario autenticado cargar repetidamente archivos que se acumulan en el disco hasta que se ejecuta la limpieza peri\u00f3dica, agotando potencialmente el espacio en disco disponible en el host."}], "lastModified": "2026-10-29T19:17:24.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C0D5E843-3923-4473-B810-8B7DAAED1640", "versionEndExcluding": "1.123.58"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "46606938-85AC-4EFB-ACF1-D4928DB1DE79", "versionEndExcluding": "1.123.58"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "66F12A64-36CD-426C-953C-1241930B85F1", "versionEndExcluding": "2.28.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FB416B55-F149-4B73-A880-383334CB89E4", "versionEndExcluding": "2.28.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}