CVE-2026-58661

unknowncovered by 1 sourcefirst seen 2026-07-10

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

⚡ Watch CVE-2026-58661

Get an email if CVE-2026-58661 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-58661: n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vul…nvd · 2026-07-10

External references

NVD record for CVE-2026-58661

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-58661 status](https://www.csirts.com/badge/CVE-2026-58661)](https://www.csirts.com/cve/CVE-2026-58661)