CVE-2026-58661: n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint

Published Jul 10, 2026
·
Updated

Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

Patches Users should upgrade to the patched version once available to remediate the vulnerability.

Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Set uploadMaxFileSize to a low value to limit individual upload size. - Monitor and alert on disk usage in the n8n temporary upload directory.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Other sources

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

MITRE

Affected Software

7 affected componentsFixes available
n8n n8n<2.28.0, <1.123.58
n8n N8n Node.js<1.123.58
n8n N8n Node.js<1.123.58
n8n N8n Node.js>=2.0.0<2.28.0
n8n N8n Node.js>=2.0.0<2.28.0
npm/n8n<1.123.58
1.123.58
npm/n8n>=2.0.0<2.28.0
2.28.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/n8n to a version that resolves this vulnerability.

    Fixed in 1.123.58
  2. Upgrade

    Upgrade npm/n8n to a version that resolves this vulnerability.

    Fixed in 2.28.0
  3. Upgrade

    Upgrade n8n to a version that resolves this vulnerability.

    Fixed in 2.28.0
  4. Upgrade

    Upgrade n8n to a version that resolves this vulnerability.

    Fixed in 1.123.58
  5. Configuration

    Set uploadMaxFileSize to a low value to limit individual upload size.

    n8n uploadMaxFileSize = low value
  6. Compensating control

    Restrict n8n instance access to fully trusted users only.

  7. Compensating control

    Monitor and alert on disk usage in the n8n temporary upload directory.

Event History

Jul 10, 2026
CVE Published
via MITRE·01:58 PM
Data Sourced
via MITRE·01:58 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Jul 22, 2026
Advisory Published
via GitHub·10:25 PM
Data Sourced
via GitHub·10:25 PM
DescriptionWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-58661?

CVE-2026-58661 has a medium severity rating of 5.3 according to the CVSS score.

2

How do I fix CVE-2026-58661?

To mitigate CVE-2026-58661, upgrade n8n to version 2.28.0 or later, or version 1.123.58 or later for the 1.x branch.

3

What is the impact of CVE-2026-58661?

CVE-2026-58661 allows an authenticated user to exhaust disk space through repeated file uploads to a data-table endpoint.

4

Which versions of n8n are affected by CVE-2026-58661?

CVE-2026-58661 affects n8n versions prior to 2.28.0 and 1.x branch versions before 1.123.58.

5

Who is impacted by CVE-2026-58661?

Authenticated users of n8n systems running vulnerable versions may exploit CVE-2026-58661, leading to potential disk space depletion.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203