CVE-2026-58661: n8n Disk Space Exhaustion Vulnerability – Patch Guidance

Technical summary

The vulnerability exists in n8n's data-table file upload endpoint, which performs per-request quota validation but fails to account for previously uploaded files persisting in the shared temporary directory. The quota check validates individual upload requests against a size limit, but does not assess cumulative temporary file usage across multiple requests. This allows an authenticated user to bypass quota enforcement by distributing uploads across multiple requests, with accumulated temporary files remaining until the periodic cleanup mechanism executes. The flaw maps to CWE-770 (Allocation of Resources Without Limits or Throttling), a resource exhaustion pattern where insufficient guards prevent unbounded resource consumption.

Business impact

A successful exploit results in denial of service through disk exhaustion. As temporary files accumulate faster than the cleanup cycle can remove them, available disk space depletes, causing application logs to fail, database operations to stall, and eventually forcing service unavailability. For organizations relying on n8n for critical workflow automation (data pipelines, API orchestration, integration tasks), this can halt business processes dependent on those workflows. Recovery requires manual disk cleanup and service restart, creating operational overhead and potential data processing delays. The impact is not confidentiality or integrity compromise, but availability—justifying the MEDIUM severity rating.

Affected systems

n8n versions prior to 2.28.0 on the current 2.x line and versions prior to 1.123.58 on the legacy 1.x maintenance branch are affected. All deployments of these versions—whether self-hosted on-premises, containerized (Docker/Kubernetes), or cloud-based—are vulnerable if users can authenticate to the platform. Organizations must identify their current n8n deployment version and compare against the patched versions. The vulnerability does not require network exposure or privilege escalation; it requires only valid user credentials.

Exploitability

Exploitability is relatively straightforward for authenticated users. An attacker with valid n8n credentials can script repeated file uploads to the data-table endpoint, each bypassing individual quota checks, to systematically exhaust disk space. No complex attack chains, privilege escalation, or zero-day techniques are required. However, the requirement for valid authentication significantly limits the threat surface to insider threats, compromised user accounts, or supply-chain compromises where credentials are obtained. The CVSS score of 4.3 (MEDIUM, Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, Availability Impact: Low) reflects this balance: trivial execution method offset by authentication requirement and limited (not catastrophic) availability impact.

Remediation

Upgrade n8n to version 2.28.0 or later on the 2.x line, or to version 1.123.58 or later on the 1.x line if you remain on legacy support. These releases include corrected quota enforcement that accounts for cumulative temporary file usage, preventing unbounded accumulation. Before patching, consider temporary mitigations: (1) restrict file upload permissions to trusted users only, reducing the threat surface; (2) implement filesystem monitoring to alert on rapid disk utilization changes; (3) increase the frequency or aggressiveness of temporary file cleanup if the deployment supports configuration tuning; (4) monitor disk capacity closely to catch exploitation attempts before exhaustion occurs.

Patch guidance

Review your n8n deployment to determine the currently installed version. If running 2.x, upgrade to 2.28.0 or later. If running 1.x, upgrade to 1.123.58 or later (or transition to 2.x if legacy support is ending). Verify compatibility with your configuration, custom workflows, and extensions before applying patches. Test patched versions in a staging environment to confirm the quota fix does not inadvertently block legitimate large file uploads. After patching, confirm that temporary file accumulation no longer occurs under normal and stress-test conditions. For containerized deployments, rebuild images with the patched version; for cloud-hosted n8n, verify that your service provider has deployed the patch or is scheduled to deploy it.

Detection guidance

Monitor for sustained disk utilization growth in the filesystem hosting n8n's temporary directory, particularly the rate of file creation in that directory. Correlate disk growth with upload request logs to identify anomalous patterns (e.g., repeated uploads from a single user or session in quick succession). Enable verbose logging on the data-table file upload endpoint if available. Check periodic cleanup job logs to confirm they are running successfully; if cleanup tasks are failing silently, temporary files will accumulate even without active exploitation. Implement filesystem event monitoring (auditd on Linux, Windows Event Tracing) to detect rapid temporary file creation. Set up alerting on disk utilization thresholds to trigger before exhaustion becomes critical.

Why prioritize this

While CVSS 4.3 (MEDIUM) suggests lower priority than high or critical vulnerabilities, the ease of exploitation, potential for service disruption, and applicability to all n8n deployments warrant prompt attention. Disk exhaustion can cascade into data loss or corruption if systems fail ungracefully, and recovery is disruptive. Organizations operating n8n in production should prioritize patching within their standard security update cycle (typically 30–60 days). Those with tight disk resources or multi-tenant deployments where user isolation is limited should accelerate patching. Because KEV status is not assigned, this is not an immediate zero-day crisis, but should not be delayed indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network attack vector (n8n is typically web-accessible), (2) Low attack complexity (no special setup or race conditions required), (3) Low privilege requirement (any authenticated user can exploit), (4) No user interaction needed (attacks are fully automated), (5) Limited availability impact (service degradation or brief outage, not total data loss). The lack of confidentiality or integrity impact caps the score at MEDIUM. Organizations should interpret this as a moderate but not severe risk requiring timely remediation, not emergency response.

Frequently asked questions