n8n CVE-2026-21858 (authentication bypass) is added to the CISA KEV catalog on or before 2027-01-11.
OPEN · EXPERIMENTAL
- id
- SO-2026-002
- class
- EVIDENCE_PUBLICATION
- claim
- n8n CVE-2026-21858 (authentication bypass) is added to the CISA KEV catalog on or before 2027-01-11.
- issued
- 2026-10-13T12:30:00Z
- probability
- 0.5
- benchmark
- 0.5
- benchmark kind
- ANALYST_PRIOR
- benchmark basis
- Judgment. One vendor-research exploitation claim (VulnCheck) and ~14,000 exposed instances; CISA has admitted single-vendor-telemetry claims before (Huntress, watchTowr) but not reliably. Tests the catalog-coverage observation on the record.
- adjustment
- 0
- resolution rule
- YES if CISA KEV lists CVE-2026-21858 with dateAdded on or before 2027-01-11.
- admissibility
- Only publications dated after 2026-10-13T12:30Z count; for EVENT-class, only events occurring after that timestamp count. Evidence pre-dating issuance resolves the forecast RETROSPECTIVE_DISCOVERY, not YES.
- exclusions
- Not recorded
- resolves
- 2027-01-11
- status
- OPEN
- outcome date
- Not recorded
- outcome basis
- Not recorded
- brier
- Not recorded
- benchmark brier
- Not recorded
- resolution source
- EXTERNAL
- experimental
- true
- false positive cost
- Over-forecast would overstate CISA uptake of single-source claims.
- ledger hash
- 90c0a5799ebe9ff4
- revision log
- record links