Vulnerability Description
n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| N8N | N8N | < 1.123.58 |
Related Weaknesses (CWE)
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pvMitigationVendor Advisory
- https://www.vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-fiThird Party Advisory
FAQ
What is CVE-2026-58661?
CVE-2026-58661 is a vulnerability with a CVSS score of 4.3 (MEDIUM). n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files ...
How severe is CVE-2026-58661?
CVE-2026-58661 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-58661?
Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.