Loading story…
A maximum-severity vulnerability, tracked as CVE-2026-21858 and dubbed 'Ni8mare,' was disclosed in the n8n workflow automation platform, allowing unauthenticated remote code execution and potential full system compromise on locally deployed instances running versions prior to 1.121.0. The flaw arises from improper validation of incoming data in form-based workflows, enabling attackers to craft requests that bypass expected content-type checks and execute arbitrary code. This vulnerability has drawn significant attention in the security community, with reports highlighting the risk of full environment compromise and the rapid exploitation potential due to n8n's widespread use in automation and integration workflows. Concurrently, underground forums have surfaced with alleged exploit sales targeting n8n, further amplifying the threat landscape for organizations relying on this platform.
In addition to the core vulnerability, researchers identified a supply chain attack involving malicious npm packages masquerading as legitimate n8n integrations. These packages, once installed, exfiltrate OAuth tokens and API keys from enterprise workflows, representing a new escalation in supply chain threats targeting automation platforms. While there is no confirmed link between the npm supply chain attack and the CVE-2026-21858 vulnerability, both incidents underscore the growing focus of threat actors on the n8n ecosystem. Security experts warn that organizations may overlook these risks, as automation platforms often operate deep within business processes and may not be subject to the same scrutiny as traditional build systems. The convergence of a critical RCE flaw and active supply chain threats highlights the urgent need for patching, vigilant monitoring of third-party integrations, and enhanced supply chain security practices for n8n deployments.
Trace attribution and downstream blast radius.
11 events from the most recent confirmed update back to the earliest known activity.
The recap reported that a BreachForums user database leak was posted on a site branded as ShinyHunters. This marked a new exposure of forum user data in the criminal ecosystem.
A command-injection vulnerability in Amazon's Kiro GitLab Merge Request Helper was reported and assigned CVE-2026-0830. The issue was included among the week's notable newly disclosed flaws.
The Hacker News summary highlighted a critical zlib untgz overflow vulnerability, assigned CVE-2026-22184. It was presented as one of the notable newly tracked security issues in the reporting period.
The weekly recap noted high exploitation volumes involving the 'React2Shell' vulnerability. The reporting characterized the flaw as being actively abused at significant scale.
A Russia-linked campaign known as PHALT#BLYX was reported targeting the hospitality sector. The attackers used ClickFix social engineering and MSBuild to deliver obfuscated DCRat malware.
Researchers reported malicious Chrome extensions being used to exfiltrate data from AI chat platforms in activity dubbed 'Prompt Poaching.' The campaign highlighted browser-based theft of sensitive prompts and related user data.
The recap described a China-linked espionage campaign by UAT-7290 against telecom organizations in South Asia. The operation used multiple Linux malware families to support intrusions.
Suspected China-linked attackers were reported using a compromised SonicWall VPN appliance to deploy an ESXi exploit chain. The activity was tied to VMware zero-days that had originally been disclosed in March 2025.
The weekly recap said the Kimwolf Android botnet grew past 2 million infections. It reportedly abuses residential proxy networks to reach internal devices and scan for exposed Android Debug Bridge services.
The Hacker News reported a critical n8n workflow automation vulnerability, tracked as CVE-2026-21858 and nicknamed 'Ni8mare,' that can enable unauthenticated remote code execution in locally deployed instances before version 1.121.0. The issue stems from flawed form and file-handling logic, though exploitation may depend on uncommon deployment conditions.
SOCRadar observed new underground forum posts during the week of publication advertising an alleged exploit for the n8n automation platform and a full-chain exploit for Apple iOS devices. The same monitoring also noted a resurfaced dataset purportedly containing Instagram user data and other hacking-service offers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple critical vulnerabilities have been disclosed in the open-source workflow automation platform n8n, exposing both self-hosted and cloud deployments to severe security risks. The most severe flaw, tracked as CVE-2026-21877, allows authenticated attackers to execute arbitrary code on affected instances, potentially granting full control over the system. This vulnerability impacts a wide range of n8n installations, and while patches have been released, unpatched systems remain at risk. Another critical flaw, CVE-2026-21858, has also been highlighted, with reports indicating that over 100,000 servers could be exposed due to the public release of exploit code. Security researchers have emphasized the urgency of applying available patches to mitigate these threats, as the public availability of exploits significantly increases the likelihood of widespread attacks. Organizations using n8n are strongly advised to update their deployments immediately and review their exposure, especially if instances are accessible from the internet. The vulnerabilities underscore the importance of timely patch management and monitoring for signs of compromise in automation and integration platforms.
Jun 29, 2026
Researchers reported **critical vulnerabilities in the n8n low-code workflow automation platform** that can enable **host-level compromise**. The issues include **CVE-2026-1470 (CVSS 9.9)** and **CVE-2026-0863 (CVSS 8.5)**, described as allowing attackers to **bypass security controls**, achieve **arbitrary code execution**, and potentially obtain **full control of n8n services**, with downstream exposure of **credentials, API keys, and other sensitive data**. Impact spans **cloud deployments** as well as **self-hosted instances** that have not been patched. Given n8n’s common use to integrate SaaS services and increasingly to orchestrate **LLM-enabled business workflows**, successful exploitation could provide broad access to connected systems and secrets stored in workflows. Coverage also noted the disclosures follow an earlier, separate critical n8n issue reported in late 2025, reinforcing the need for tighter vulnerability management around automation/orchestration tooling. Organizations were urged to **upgrade to patched versions** and review hardening controls for n8n deployments, particularly where the platform has access to high-privilege tokens and production integrations.
Jun 29, 2026
A critical remote code execution vulnerability, tracked as CVE-2026-21877, has been identified in the n8n workflow automation platform. The flaw, rated CVSS 10.0, allows authenticated users to execute arbitrary code on affected n8n instances, posing a significant risk to environments where n8n is used to automate workflows with access to sensitive data, internal systems, and credentials. The vulnerability impacts n8n versions from 0.123.0 up to but not including 1.121.3, affecting both self-hosted and managed deployments. Exploitation requires authenticated access, and the vulnerability is linked to unsafe handling that can result in the execution of untrusted code. The issue has been addressed in n8n version 1.121.3 and later, and users are strongly advised to upgrade immediately to mitigate the risk. Additional recommendations include restricting workflow modification access to trusted administrators, blocking high-risk nodes at runtime, and reviewing audit logs for suspicious activity prior to patching. No public exploit details or proof-of-concept have been released as of the latest advisories. Organizations using n8n should prioritize patching and implement hardening measures to prevent potential compromise of their automation infrastructure.
Jun 29, 2026