CVE-2026-58661: N8n Disk Space Exhaustion DoS Vulnerability

CVE-2026-58661 Overview

CVE-2026-58661 is a disk space exhaustion vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the data-table file upload endpoint, where the per-request quota check fails to account for files already written to the shared temporary directory. An authenticated user can repeatedly upload files that accumulate on disk until the periodic cleanup routine runs, potentially exhausting available storage on the host. The issue affects n8n versions before 2.28.0 on the 2.x branch and before 1.123.58 on the 1.x branch. The vulnerability is tracked under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
An authenticated attacker can exhaust host disk space by abusing the data-table file upload endpoint, degrading availability of the n8n service and any co-located workloads.

Affected Products

n8n Community edition (Node.js) versions before 2.28.0
n8n Enterprise edition (Node.js) versions before 2.28.0
n8n 1.x branch versions before 1.123.58

Discovery Timeline

2026-07-10 - CVE-2026-58661 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-58661

Vulnerability Analysis

The vulnerability affects the data-table file upload endpoint in n8n. n8n enforces a quota that is intended to limit the amount of disk space a single upload request can consume. However, the quota check evaluates each request in isolation. It does not include the cumulative size of files already staged in the shared temporary directory from prior uploads.

An authenticated user can iterate the upload endpoint indefinitely. Each individual request passes the per-request quota check while the shared temporary directory grows without bound. Files remain on disk until the periodic cleanup task executes, meaning attackers can outpace the cleanup interval and drive the host toward full disk utilization.

Exhausting disk space affects the availability of n8n itself and any other service sharing the volume. Workflow execution, logging, database writes, and container runtime operations may fail. See the GitHub Security Advisory GHSA-w867-jm58-p9pv and the VulnCheck Advisory for vendor detail.

Root Cause

The root cause is improper resource accounting during file upload validation. The quota logic checks only the size of the incoming request against the configured limit. It ignores the aggregate size of files previously written to the shared temporary directory, violating the resource-throttling principle described by [CWE-770].

Attack Vector

Exploitation requires network access to the n8n API and valid low-privileged authentication. The attacker issues repeated file upload requests to the data-table endpoint, each sized to pass the per-request quota. Files accumulate in the shared temp directory faster than periodic cleanup removes them, ultimately consuming all available disk space on the host.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no realCodeExamples were provided by the vendor advisory.

Detection Methods for CVE-2026-58661

Indicators of Compromise

Rapid growth of the n8n shared temporary directory used for data-table uploads.
High-volume POST requests from a single authenticated user to the data-table file upload endpoint.
Disk utilization alerts on the n8n host or persistent volume trending toward 100 percent.
Failed workflow executions or database write errors correlated with low free disk space.

Detection Strategies

Baseline normal upload frequency per user and alert on deviations to the data-table endpoint.
Monitor filesystem usage on volumes backing n8n and trigger on sustained growth without corresponding cleanup.
Correlate authenticated session identifiers with upload request counts and cumulative payload size.

Monitoring Recommendations

Ingest n8n application and access logs into a centralized logging or SIEM platform for query and alerting.
Track per-user API request rates and cumulative uploaded bytes over rolling windows.
Alert on temp directory size crossing operator-defined thresholds and on periodic cleanup task failures.

How to Mitigate CVE-2026-58661

Immediate Actions Required

Upgrade n8n to version 2.28.0 or later on the 2.x branch, or to 1.123.58 or later on the 1.x branch.
Audit accounts with access to the data-table file upload endpoint and revoke access from unnecessary users.
Enforce filesystem quotas on the volume hosting the shared temporary directory to contain worst-case exhaustion.
Review recent access logs for high-volume upload patterns predating the upgrade.

Patch Information

The vendor has released fixed versions. Upgrade to n8n 2.28.0 or later, or to 1.123.58 or later on the 1.x branch. Details are available in the GitHub Security Advisory GHSA-w867-jm58-p9pv.

Workarounds

Restrict access to the data-table file upload endpoint using network-layer controls or reverse-proxy rules until patching is complete.
Reduce the periodic cleanup interval so accumulated files are purged more aggressively from the shared temp directory.
Place the n8n temporary directory on a dedicated volume with a strict size limit to prevent host-wide disk exhaustion.
Apply per-user rate limiting at an ingress proxy to cap upload frequency and cumulative payload size.

bash

# Configuration example: isolate n8n temp storage and cap its size
# Mount a dedicated, size-limited tmpfs or volume for the shared upload directory
mount -t tmpfs -o size=1G,mode=1777 tmpfs /var/lib/n8n/tmp
export N8N_BINARY_DATA_TTL=60