Security alerts
What to fix right now.
Short alerts when a serious flaw hits sites like yours: what happened, who is affected, how to check your site and what to do. The important ones from the past year are here too, in case you missed them. Every alert cites its official sources.
Security alerts
January 2026
n8n Ni8mare: critical flaw reachable without login, update self-hosted n8n
CVE-2026-21858, rated 10 out of 10, lets an attacker read server files through n8n forms without logging in.
December 2025
n8n: actively exploited code execution flaw, update self-hosted instances
A critical n8n flaw (CVE-2025-68613) lets a logged-in user run commands on the server. It is exploited in the wild.