CVE-2026-58661: n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
References
- github.com/advisories/GHSA-w867-jm58-p9pv
- github.com/n8n-io/n8n/releases/tag/n8n@1.123.58
- github.com/n8n-io/n8n/releases/tag/n8n@2.28.0
- github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv
- nvd.nist.gov/vuln/detail/CVE-2026-58661
- www.vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-file-upload-endpoint
Code Behaviors & Features
Detect and mitigate CVE-2026-58661 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →