CVE-2026-58661: n8n disk exhaustion

Q: Is CVE-2026-58661 actively exploited?

No confirmed active exploitation of CVE-2026-58661 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-58661?

Patch n8n to 2.28.0 or later (1.123.58+ on the 1.x branch) — this is the primary fix since it corrects the quota check to account for already-written temp files. Until patched: restrict which authenticated users/roles can access data-table file upload functionality; monitor disk utilization on n8n hosts with alerting thresholds well below capacity; monitor the shared temp directory size and file count as a leading indicator; consider running n8n with a dedicated disk/volume for temp storage so exhaustion doesn't impact other services; review and, if needed, manually trigger the periodic cleanup job more frequently as a stopgap. Detection: alert on abnormal upload request volume per user/account and on rapid growth of the n8n temp directory.

Q: What systems are affected by CVE-2026-58661?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration pipelines.

Q: What is the CVSS score for CVE-2026-58661?

CVE-2026-58661 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.39%.

CISO Take

n8n's data-table file upload endpoint checks quota per individual request but never accounts for files already accumulated on disk, so an authenticated user can repeatedly upload files that pile up in the shared temp directory faster than the periodic cleanup job clears them. This isn't a novel AI attack technique, but n8n is widely used to orchestrate LLM agent workflows, so a single low-privilege account with data-table access can degrade or crash the host running those pipelines through simple, repeated, low-complexity requests. There's no CISA KEV listing, no public exploit or Nuclei template, and no EPSS data yet, which points to opportunistic rather than imminent exploitation risk — but the barrier to abuse is trivial (no special tooling, no AI/ML expertise required), so it should not be deprioritized purely on sophistication grounds. Patch to n8n 2.28.0 (or 1.123.58 on the 1.x branch) and, in the interim, monitor disk utilization on hosts running n8n and restrict data-table upload access to trusted accounts only.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

Medium severity, consistent with the vendor rating: exploitation requires only an authenticated account (no privilege escalation or special access needed) and is trivial to execute — repeated, unremarkable upload requests. Impact is limited to availability (disk exhaustion → potential service disruption or crash of n8n and any co-located workloads) rather than confidentiality or integrity. No active exploitation signals: not in CISA KEV, no public PoC, no EPSS score, no scanner templates. Risk is elevated by n8n's common role as an orchestration layer for AI agent workflows, where an outage has downstream operational impact on automated pipelines rather than just the n8n instance itself.

How does the attack unfold?

Initial Access

Adversary obtains or already holds an authenticated n8n account with access to the data-table file upload endpoint.

AML.T0012

Exploitation

Adversary repeatedly uploads files; each request passes the per-request quota check because it ignores files already accumulated in the shared temp directory from prior uploads.

AML.T0034

Resource Exhaustion

Uploaded files accumulate on disk faster than the periodic cleanup job removes them, progressively consuming available host disk space.

Impact

Host disk space is exhausted, degrading or crashing the n8n instance and any AI agent workflows or co-located services it orchestrates.

AML.T0029

Initial Access

Adversary obtains or already holds an authenticated n8n account with access to the data-table file upload endpoint.

AML.T0012

Exploitation

Adversary repeatedly uploads files; each request passes the per-request quota check because it ignores files already accumulated in the shared temp directory from prior uploads.

AML.T0034

Resource Exhaustion

Uploaded files accumulate on disk faster than the periodic cleanup job removes them, progressively consuming available host disk space.

Impact

Host disk space is exhausted, degrading or crashing the n8n instance and any AI agent workflows or co-located services it orchestrates.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.0.0, < 2.28.0	`2.28.0`
201.9K OpenSSF 6.7 Pushed 2d ago 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I None

A Low

What should I do?

1 step

Patch n8n to 2.28.0 or later (1.123.58+ on the 1.x branch) — this is the primary fix since it corrects the quota check to account for already-written temp files. Until patched: restrict which authenticated users/roles can access data-table file upload functionality; monitor disk utilization on n8n hosts with alerting thresholds well below capacity; monitor the shared temp directory size and file count as a leading indicator; consider running n8n with a dedicated disk/volume for temp storage so exhaustion doesn't impact other services; review and, if needed, manually trigger the periodic cleanup job more frequently as a stopgap. Detection: alert on abnormal upload request volume per user/account and on rapid growth of the n8n temp directory.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent AML.T0029 - Denial of AI Service AML.T0034 - Cost Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE-4.1 - Risks and benefits of the AI system are monitored on an ongoing basis

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-58661?

n8n's data-table file upload endpoint checks quota per individual request but never accounts for files already accumulated on disk, so an authenticated user can repeatedly upload files that pile up in the shared temp directory faster than the periodic cleanup job clears them. This isn't a novel AI attack technique, but n8n is widely used to orchestrate LLM agent workflows, so a single low-privilege account with data-table access can degrade or crash the host running those pipelines through simple, repeated, low-complexity requests. There's no CISA KEV listing, no public exploit or Nuclei template, and no EPSS data yet, which points to opportunistic rather than imminent exploitation risk — but the barrier to abuse is trivial (no special tooling, no AI/ML expertise required), so it should not be deprioritized purely on sophistication grounds. Patch to n8n 2.28.0 (or 1.123.58 on the 1.x branch) and, in the interim, monitor disk utilization on hosts running n8n and restrict data-table upload access to trusted accounts only.

Is CVE-2026-58661 actively exploited?

No confirmed active exploitation of CVE-2026-58661 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-58661?

Patch n8n to 2.28.0 or later (1.123.58+ on the 1.x branch) — this is the primary fix since it corrects the quota check to account for already-written temp files. Until patched: restrict which authenticated users/roles can access data-table file upload functionality; monitor disk utilization on n8n hosts with alerting thresholds well below capacity; monitor the shared temp directory size and file count as a leading indicator; consider running n8n with a dedicated disk/volume for temp storage so exhaustion doesn't impact other services; review and, if needed, manually trigger the periodic cleanup job more frequently as a stopgap. Detection: alert on abnormal upload request volume per user/account and on rapid growth of the n8n temp directory.

What systems are affected by CVE-2026-58661?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration pipelines.

What is the CVSS score for CVE-2026-58661?

CVE-2026-58661 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation / orchestration pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034 Cost Harvesting

Compliance Controls Affected

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

Exploitation Scenario

An adversary who has obtained or been granted a low-privilege, authenticated n8n account with access to the data-table feature scripts repeated file uploads to the data-table upload endpoint. Each individual upload passes the per-request quota check since that check ignores files already sitting in the shared temp directory from prior uploads. The attacker loops the upload requests faster than the periodic cleanup job runs, causing files to accumulate until the host's available disk space is exhausted. This can crash or degrade the n8n instance and any AI agent workflows it orchestrates, and may impact other services sharing the same disk volume — all without needing any AI/ML-specific knowledge, just sustained, ordinary-looking upload traffic.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.