Loading story…
A critical CVSS 10.0 vulnerability in locally deployed n8n automation instances, tracked as CVE-2026-21858 and dubbed Ni8mare, enables unauthenticated attackers to read arbitrary local files, bypass authentication, and execute commands. The flaw stems from Content-Type confusion in webhook parsing: the Form Webhook node can invoke file handling without requiring multipart/form-data, allowing attacker-controlled file paths to be copied into persistent storage. Researchers estimate that roughly 100,000 internet-exposed servers may be affected.
Attackers can use the file-read primitive to obtain sensitive files, including /etc/passwd, the local SQLite database, and n8n configuration secrets. With database contents and the instance secret, they can forge an n8n-auth session cookie, gain administrator access, and create workflows using the Execute Command node for remote code execution. Organizations running self-hosted n8n should upgrade to version 1.121.0 or later; no official workaround is available.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
n8n assigned CVE-2026-21858 to the critical Content-Type confusion flaw, which can enable arbitrary local-file reads, authentication bypass, and code execution on locally deployed instances.
n8n published a patched version addressing the reported unauthenticated file-access vulnerability.
n8n acknowledged receipt of Cyera Research Labs' vulnerability report.
Cyera Research Labs reported the critical n8n file-access vulnerability to n8n through responsible disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability, tracked as CVE-2026-21858 and dubbed "Ni8mare," has been discovered in the open-source workflow automation platform n8n. This flaw allows unauthenticated remote attackers to gain full control over vulnerable n8n instances by exploiting a content-type confusion issue in the platform's workflow processing. The vulnerability, rated CVSS 10.0, enables attackers to access files on the underlying server, potentially exposing sensitive information and allowing further compromise depending on the deployment and workflow configuration. Researchers at Cyera identified and reported the issue, and n8n has issued advisories urging immediate patching. The Ni8mare vulnerability is distinct from other recent critical flaws in n8n, as it does not require any credentials for exploitation. Over 100,000 n8n servers are believed to be at risk, with the platform widely used for automating tasks and integrating AI services. Administrators are strongly advised to update to the latest secure version and review workflow configurations to mitigate the risk of unauthorized access and system compromise. The disclosure follows a series of high-severity vulnerabilities in n8n, underscoring the urgent need for robust security practices in workflow automation environments.
Aug 15, 2026
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026
A critical remote code execution vulnerability, tracked as CVE-2026-21877, has been identified in the n8n workflow automation platform. The flaw, rated CVSS 10.0, allows authenticated users to execute arbitrary code on affected n8n instances, posing a significant risk to environments where n8n is used to automate workflows with access to sensitive data, internal systems, and credentials. The vulnerability impacts n8n versions from 0.123.0 up to but not including 1.121.3, affecting both self-hosted and managed deployments. Exploitation requires authenticated access, and the vulnerability is linked to unsafe handling that can result in the execution of untrusted code. The issue has been addressed in n8n version 1.121.3 and later, and users are strongly advised to upgrade immediately to mitigate the risk. Additional recommendations include restricting workflow modification access to trusted administrators, blocking high-risk nodes at runtime, and reviewing audit logs for suspicious activity prior to patching. No public exploit details or proof-of-concept have been released as of the latest advisories. Organizations using n8n should prioritize patching and implement hardening measures to prevent potential compromise of their automation infrastructure.
Jun 29, 2026