Ni8mare Flaw in n8n: What Defenders Need to Know About CVE-2026-21858

Security researchers disclosed a new maximum-severity vulnerability in n8n, a widely used open-source automation tool, raising serious concerns for organizations running exposed or outdated instances. The issue, tracked as CVE-2026-21858 and nicknamed Ni8mare, allows an unauthenticated attacker to fully compromise vulnerable n8n deployments.

What Is CVE-2026-21858 and Why Is It Critical?

CVE-2026-21858 carries a CVSS score of 10.0, reflecting its worst-case impact. Successful exploitation can lead to arbitrary file reads, authentication bypass, and ultimately Remote Code Execution (RCE). Because n8n often stores API keys, OAuth tokens, database credentials, and cloud access details, a single compromised instance can expose a wide range of connected systems.

Security researchers from Cyera Research Labs reported that the vulnerability affects locally deployed n8n environments, including Docker-based installations, which are common in enterprise setups.

Which n8n Versions Are Affected?

All n8n versions up to and including 1.65.0 are vulnerable. The issue was fixed in version 1.121.0, released in November 2025. Since then, several newer versions have been published, and upgrading beyond the fixed release is strongly recommended.

Importantly, there are no official workarounds that fully mitigate the flaw without patching. Organizations running older versions remain exposed as long as the service is reachable.

How Does the Ni8mare Vulnerability (CVE-2026-21858) Work?

The flaw is caused by a mismatch between how n8n parses incoming HTTP requests and how certain workflows later handle uploaded files. n8n relies heavily on webhooks and Forms to receive external input, such as user messages, uploaded documents, or API data. To process this input, n8n first inspects the request’s Content-Type header and then chooses one of two parsing paths.

In simplified terms, the request handling flow works like this:

1. Content-Type inspection – n8n checks the Content-Type header of the incoming request to determine how the body should be parsed.
2. Parsing decision – If the request is labeled as multipart/form-data, n8n invokes a dedicated file upload parser. For all other content types, such as application/json, it falls back to a regular body parser.
3. Data placement – The file upload parser stores file metadata in a file-specific internal object, while the regular body parser stores decoded request data in a general-purpose request object.

Where the Validation Breaks Down

Under normal conditions, file-handling logic is only executed after the file upload parser has safely processed uploaded files. However, the vulnerability appears in Form-based workflows where file-handling functions are executed without first verifying that the request was actually processed as multipart/form-data.

This gap allows an attacker to deliberately send a request using a non-file content type while crafting the request body to mimic the internal structure expected for uploaded files. Because the regular body parser does not strictly validate the shape of incoming data, the attacker can fully control the internal file reference object.

As a result:

• The attacker can point file references to arbitrary file paths on the n8n host
• n8n treats those paths as legitimate uploaded files
• The workflow copies and processes the contents of local system files

This flaw effectively turns Form workflows into an arbitrary file read primitive. Instead of processing user-uploaded documents, the workflow can be tricked into reading sensitive system files, configuration data, or internal databases stored on the n8n host. From there, attackers can extract secrets and credentials that enable further compromise.

How Can This Lead to Full System Takeover?

Once arbitrary file access is achieved, the impact extends. Attackers can use access to local database files to extract administrator account details, including user identifiers and password hashes. Configuration files stored on the host may also expose secret keys used to sign authentication cookies.

By combining this information, a threat actor can forge a valid administrative session and bypass authentication entirely. With administrative access in place, the attacker gains the ability to create or modify workflows, including those that support command execution. At that point, the vulnerability escalates from a parsing flaw into full RCE, granting complete control over the n8n instance.

Public PoC Increases Risk for Widely Exposed n8n Instances

A Proof-of-Concept (PoC) exploit for CVE-2026-21858 has been released, significantly increasing the risk to already exposed n8n deployments. According to Cyera, an estimated 100,000 n8n servers remain exposed globally, amplifying the potential for rapid and opportunistic exploitation.

With a working PoC publicly available, organizations that have not yet upgraded to n8n 1.121.0 or later face an elevated likelihood of real-world attacks and should prioritize remediation immediately.

How Do Recent n8n Vulnerabilities Change the Risk Picture?

Recently, n8n has addressed several other critical vulnerabilities that further illustrate how workflow automation platforms have become high-value targets for attackers.

These include CVE-2026-21877, a max-severity RCE flaw; CVE-2025-68668, which allowed command execution; and CVE-2025-68613, another yet another RCE issue under specific conditions. While each vulnerability differs technically, they share a common theme: automation platforms often run with broad permissions and direct access to sensitive systems, amplifying the impact of any single weakness.

This trend reinforces the need for continuous visibility into exposed automation infrastructure and timely vulnerability response. Solutions such as SOCRadar’s Cyber Threat Intelligence and Attack Surface Management capabilities can help organizations track newly disclosed flaws, identify exposed n8n instances, and prioritize remediation before exploitation occurs.

What Immediate Steps Should Defenders Take?

Security teams should prioritize the following actions:

• Upgrade n8n to version 1.121.0 or later immediately
• Avoid exposing n8n instances directly to the internet
• Enforce authentication on all Forms and webhook endpoints
• Review workflows that handle file uploads for unnecessary exposure
• Maintain visibility into exposed automation services and newly disclosed vulnerabilities through external monitoring and threat intelligence, helping teams respond faster

For a deeper technical breakdown of the Ni8mare vulnerability and exploitation chain, refer to the research article.