Over 100,000 Internet-Exposed n8n Instances Vulnerable to RCE Attacks

More than 105,000 n8n workflow automation instances have been found exposed to the internet with critical remote code execution vulnerabilities, according to a January 9, 2026 disclosure by the Shadowserver Foundation on January 9, 2026.

The alarming discovery reveals that approximately 46% of all detected n8n deployments out of 230,562 total IP addresses running the platform remain vulnerable to exploitation without authentication.

The vulnerability, tracked as CVE-2026-21858, has been assigned a maximum CVSS score of 10.0, indicating the highest severity level.

This remote code execution flaw enables attackers to execute arbitrary code on vulnerable n8n servers, potentially granting complete control over systems that often store sensitive business data and system credentials.

The scale of exposure poses a significant threat to organizations across industries that rely on n8n for workflow automation and integration.

Severity and Technical Impact

CVE-2026-21858 is a critical vulnerability in n8n’s authentication mechanisms, allowing unauthenticated attackers to execute arbitrary code on exposed instances.

The widespread deployment of n8n instances without adequate security hardening has created a substantial attack surface for threat actors.

Security researchers and the Shadowserver Foundation have warned that the combination of internet exposure and authentication bypass capabilities makes this vulnerability particularly dangerous for organizations managing multi-tenant or integration-heavy environments.

The vulnerability’s impact extends beyond individual organizations, as compromised n8n instances could serve as entry points for lateral movement across business networks, particularly targeting connected systems and data stores that these workflow automation platforms typically access.

The Shadowserver Foundation has provided detailed scan data through its Vulnerable HTTP reports, enabling network administrators to identify affected systems within their infrastructure.

https://twitter.com/Shadowserver/status/2010082651450044532?ref_src=twsrc%5Etfw

Organizations can access comprehensive dashboards, tree-map visualizations, and IP-specific data through Shadowserver’s reporting infrastructure to cross-reference their network ranges against disclosed vulnerable instances.

Security teams should immediately implement several critical actions: verify deployment security configurations, apply available patches from n8n, audit access logs for suspicious activity, and restrict internet exposure for n8n instances via firewall rules or network segmentation.

Given the critical severity and large number of exposed systems, vulnerability remediation should be prioritized alongside endpoint detection and response.

The discovery underscores the importance of regular security assessments and timely patch management for internet-facing automation platforms that require access to sensitive infrastructure and business credentials.

Attribute	Details
CVE ID	CVE-2026-21858
CVSS Score	10.0 (Critical)
Vulnerability Type	Remote Code Execution (RCE)

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Over 100,000 Internet-Exposed n8n Instances Vulnerable to RCE Attacks appeared first on Cyber Security News.