Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control: CVE-2026-21858

Estimated reading time: 8 minutes

Key Takeaways:

  • CVE-2026-21858 (Ni8mare) is a maximum-severity CVSS 10.0 flaw allowing unauthenticated Remote Code Execution.
  • The vulnerability exploits a Content-Type confusion in n8n webhooks to perform arbitrary file reads.
  • Attackers can extract internal databases and encryption keys to forge administrative sessions and execute shell commands.
  • Immediate patching to version 1.121.0 or later is required to secure affected environments.

Table of Contents

Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

A critical security flaw has been identified in n8n, a widely utilized workflow automation platform. This vulnerability, tracked as CVE-2026-21858 with a maximum CVSS score of 10.0, enables unauthenticated remote attackers to obtain complete control over affected instances. The vulnerability has been codenamed Ni8mare by the researchers at Cyera Research Labs who discovered the flaw.

The vulnerability stems from a “Content-Type” confusion flaw within the n8n webhook and file-handling mechanism. Because n8n is often used to connect disparate services, including databases, cloud storage, and internal APIs, the impact of an unauthenticated compromise is exceptionally high. CVE-2026-21858 allows an attacker to extract sensitive secrets, forge administrator access, and execute arbitrary commands on the server without providing any credentials.

This discovery follows a series of other high-severity disclosures affecting the platform, including CVE-2025-68613 (CVSS 9.9), CVE-2025-68668 (CVSS 9.9), and CVE-2026-21877 (CVSS 10.0). While those vulnerabilities generally required some level of authentication, CVE-2026-21858 is accessible to any remote party with network access to the n8n instance.

Technical Analysis of CVE-2026-21858

The core of the issue resides in how n8n processes incoming data via webhooks. Webhooks are the primary method for n8n to receive data from external applications. When an HTTP request reaches a webhook, it is processed by a function called parseRequestBody(). This function determines how to handle the data based on the “Content-Type” header provided in the request.

The parseRequestBody() function branches into two distinct paths:

  1. parseFormData(): Also referred to as the file upload parser, this is triggered when the “Content-Type” is set to “multipart/form-data”. It uses the formidable Node.js module to decode form data and stores the output in a global variable named req.body.files.
  2. parseBody(): This is the regular body parser used for all other content types. It stores extracted data in the req.body variable.

The vulnerability occurs because certain file-handling functions, specifically formWebhook(), invoke a secondary function called copyBinaryFile(). This function acts on the data stored in req.body.files. However, the system fails to verify that the request actually used the “multipart/form-data” content type before proceeding with the file-handling logic.

By sending a request with a different content type-such as “application/json”-an attacker can manually populate the req.body.files object. Because the application does not validate the source of this object in this specific flow, an attacker can control the filepath parameter. This manipulation allows the attacker to instruct the server to copy any local file from the underlying filesystem instead of a legitimate uploaded file.

Exploitation Path and Remote Code Execution

An attacker can weaponize this arbitrary file read primitive to achieve full Remote Code Execution (RCE). The research indicates a multi-step process for a successful takeover:

Step 1: The attacker uses the vulnerability to read the n8n internal database, typically located at /home/node/.n8n/database.sqlite. By extracting this, the attacker obtains the administrator’s user ID, email address, and hashed passwords.

Second, the attacker targets the n8n configuration file at /home/node/.n8n/config. This file contains the encryption secret key used by the instance. With the database contents and the encryption key, the attacker can decrypt stored credentials and forge session tokens to gain administrative access to the n8n web interface.

Once administrative access is achieved, the attacker can create a new workflow containing an “Execute Command” node. This allows for the execution of arbitrary shell commands on the host system, leading to a complete compromise of the environment.

The Role of Automation in the Attack Surface

Automation platforms like n8n are increasingly targeted because they serve as central hubs for organizational data. A compromised instance provides access to a wide array of integrated services, including API credentials, OAuth tokens, and direct connections to internal databases.

Integrating a cyber threat intelligence platform is necessary to identify when these types of critical vulnerabilities are being exploited in the wild. Real-time ransomware intelligence suggests that initial access brokers frequently target automation tools to establish a foothold before deploying encryption payloads.

Utilizing a dark web monitoring service can help organizations identify if their specific instance credentials or configuration details have been leaked following an exploitation event. If the instance is exposed to the public internet, it becomes a high-priority target for automated scanning tools.

Broader Impact on Infrastructure

The vulnerability affects all versions of n8n up to and including 1.65.0. Although a patch was released in version 1.121.0, many organizations maintain older versions due to the complexity of updating integrated workflows. The “Ni8mare” vulnerability highlights the risks associated with third-party automation tools in the supply chain.

When a central automation tool is compromised, breach detection becomes more difficult as the attacker operates within a trusted environment. Organizations must monitor for brand leak alerting, which might indicate that internal configuration files or sensitive API keys have appeared on public repositories or underground forums.

Practical Takeaways for Technical Teams

For engineers and security administrators, the following technical actions are necessary to mitigate the risks associated with CVE-2026-21858:

  • Immediate Update: Upgrade n8n to version 1.121.0 or later. Versions 1.123.10, 2.1.5, 2.2.4, and 2.3.0 also contain fixes.
  • Enforce Authentication: Ensure all Webhook and Form nodes have authentication enforced to block unauthenticated entry points.
  • Network Isolation: Restricted access via VPN or an identity-aware proxy is critical for self-hosted instances.
  • File System Permissions: Use containerization to limit the scope of what the n8n process can read on the host filesystem.
  • Log Monitoring: Review access logs for unusual POST requests with unexpected “Content-Type” headers or local system paths.

Practical Takeaways for Business Leaders

From a strategic and risk management perspective, business leaders should consider the following:

  • Inventory Automation Tools: Identify all instances of workflow automation platforms (n8n, Zapier, Make) used within the organization to combat Shadow IT.
  • Supply-Chain Risk Monitoring: Include automation platforms in supply-chain risk assessments due to their high-level access permissions.
  • Credential Rotation: If compromise is suspected, assume all API keys and OAuth tokens stored within the platform are exposed and initiate rotation.
  • Incident Response Planning: Account for the “blast radius” of an integration hub compromise in formal response plans.

Contextualizing the n8n Vulnerability Series

CVE-2026-21858 is the fourth critical vulnerability disclosed by n8n in a short timeframe. This sequence suggests recurring issues in how the platform handles user input:

  • CVE-2025-68613 (CVSS 9.9): Improper control of dynamically managed code resources.
  • CVE-2025-68668 (CVSS 9.9): N8scape, a sandbox bypass for authenticated users.
  • CVE-2026-21877 (CVSS 10.0): Unrestricted file uploads leading to full compromise.

The transition to unauthenticated exploits represents a significant escalation in the threat profile, requiring organizations to prioritize internal application security and rapid patch cycles.

PurpleOps Expertise in Managing Critical Vulnerabilities

PurpleOps provides the infrastructure and intelligence necessary to defend against flaws like Ni8mare. Our approach combines proactive monitoring with deep technical analysis to identify vulnerabilities before they are exploited.

Our services simulate real-world attacks to identify the types of “Content-Type” confusion and sandbox bypasses found in the n8n reports. Additionally, our supply chain information security service helps companies evaluate the security posture of their third-party integration hubs.

To protect against the lateral movement that follows an RCE event, PurpleOps offers protect ransomware solutions. Organizations can leverage our platform and PurpleOps Solutions to maintain a resilient security posture. For high-stakes testing, explore our red team operations to see how we test resilience against the latest CVEs.

FAQ

What is CVE-2026-21858?
It is a critical vulnerability (CVSS 10.0) in n8n that allows unauthenticated attackers to read local files and achieve Remote Code Execution.

How does the “Content-Type” confusion vulnerability work?
Attackers send a request with an unexpected Content-Type header to manually populate file variables, tricking the server into reading sensitive local system files.

Which versions of n8n are affected?
All versions up to 1.65.0 are vulnerable. Organizations should upgrade to at least version 1.121.0.

How can I mitigate the Ni8mare vulnerability?
The primary mitigation is patching. Secondary measures include enforcing authentication on all webhooks and isolating the n8n instance from the public internet.

Why is this vulnerability rated CVSS 10.0?
The score reflects the maximum impact: it is unauthenticated, remotely exploitable, and provides full control over the host system and all connected services.