CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
- Published
- Jan 7, 2026
- Updated
- Jan 12, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 25, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NHigh · next 30 days
- Percentile
- 99.6%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
Sources
n8n/CVE-2026-21858
n8n Content-Type Confusion Arbitrary File Read to RCE (CVE-2026-21858)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/n8n:1.65.0(n8n/CVE-2026-21858/docker-compose.yml:services.n8n.image)
http/cves/2026/CVE-2026-21858.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl,status,word($.matchers[*].type)
- CVE-2026-21858Research
CVE-2026-21858
- CVE-2026-21858Exploit
Automated exploit chain for n8n combining arbitrary file read, admin token forgery, and sandbox bypass to achieve unauthenticated remote code execution.
Technical analysis and proof-of-concept for CVE-2026-21858, an authentication bypass and RCE in n8n, demonstrating LFI, session forgery, and full system compromise.
- CVE-2026-21858Exploit
n8n Ni8mare - Unauthenticated Arbitrary File Read to RCE Chain (CVSS 10.0)
- cve-2026-21858Exploit
POC for CVE-2026-21858
- CVE-2026-21858Exploit
Automated exploit chain for n8n achieving unauthenticated arbitrary file read, admin token forgery, and sandbox bypass to remote code execution via expression injection.
Proof-of-concept exploit for CVE-2026-21858 (ni8mare) impacting n8n versions < 1.121.0
- CVE-2026-21858Exploit
Exploit chain for unauthenticated remote code execution in n8n, combining content-type confusion and expression injection to read files, forge JWTs, and execute commands.
- CVE-2026-21858Scanner
Proof of Concept: CVE-2026-21858 is vulnerability on n8n where unauthenticated remote attackers can access sensitive files.
- CVE-2026-21858-n8n-FullChainExploit
🛡️ Official AI Security Tool module for CVE-2026-21858 + CVE-2025-68613 (n8n "Ni8mare" Unauthenticated Arbitrary File Read & Expression Injection RCE Full Chain).
Docker-based PoC environment and exploit script for CVE-2026-21858, an n8n 1.120.4 arbitrary file read and RCE flaw, providing secret extraction and an interactive shell.
- Ashwesker-CVE-2026-21858Exploit
Exploit for CVE-2026-21858, a critical unauthenticated content-type parsing flaw in n8n allowing arbitrary file read, credential theft, and remote code execution.
Ni8mare, n8n RCE
Pre-auth n8n exploit chain: arbitrary file read (CVE-2026-21858) to expression-injection RCE (CVE-2025-68613), with Docker lab, PoC scripts, analysis.
- n8n-cve-2026-21858Exploit
CVE-2026-21858 + CVE-2025-68613 — n8n unauthenticated file read to RCE exploit
Technical audit and reproduction of CVE-2026-21858, an n8n RCE chain exploiting Content-Type confusion for arbitrary file read, session forgery, and command execution.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.