# n8n CVE-2026-21858 (authentication bypass) is added to the CISA KEV catalog on or before 2027-01-11.

- **Artifact ID:** SO-2026-002
- **Status:** OPEN
- **Public record:** https://record.cybersecurityhq.com/forecasts/so-2026-002
- **Machine-record SHA-256:** `fa63fbf4540bd79b1309f2de65a974f55b0cf8fddb352031e0df2fad8d4f255e`

## Complete structured record

```json
{
  "id": "SO-2026-002",
  "class": "EVIDENCE_PUBLICATION",
  "claim": "n8n CVE-2026-21858 (authentication bypass) is added to the CISA KEV catalog on or before 2027-01-11.",
  "issued": "2026-10-13T12:30:00Z",
  "probability": 0.5,
  "benchmark": 0.5,
  "benchmark_kind": "ANALYST_PRIOR",
  "benchmark_basis": "Judgment. One vendor-research exploitation claim (VulnCheck) and ~14,000 exposed instances; CISA has admitted single-vendor-telemetry claims before (Huntress, watchTowr) but not reliably. Tests the catalog-coverage observation on the record.",
  "adjustment": 0,
  "resolution_rule": "YES if CISA KEV lists CVE-2026-21858 with dateAdded on or before 2027-01-11.",
  "admissibility": "Only publications dated after 2026-10-13T12:30Z count; for EVENT-class, only events occurring after that timestamp count. Evidence pre-dating issuance resolves the forecast RETROSPECTIVE_DISCOVERY, not YES.",
  "exclusions": null,
  "resolves": "2027-01-11",
  "status": "OPEN",
  "outcome_date": null,
  "outcome_basis": null,
  "brier": null,
  "benchmark_brier": null,
  "resolution_source": "EXTERNAL",
  "experimental": true,
  "false_positive_cost": "Over-forecast would overstate CISA uptake of single-source claims.",
  "ledger_hash": "90c0a5799ebe9ff4",
  "revision_log": [],
  "record_links": []
}
```