CVE-2026-21858

CriticalPublished

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

Published: Jan 7, 2026
Updated: Jan 12, 2026
Assigning CNA: GitHub_M
Evidence observed: Aug 25, 2026

Primary CVSS

10.0/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS probability estimate

78.2%

High · next 30 days

Percentile: 99.6%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.

Sources

Repository evidence: Files: 2 · Repositories: 2

1 Template1 Lab

n8n Content-Type Confusion Arbitrary File Read to RCELab
n8n/CVE-2026-21858
n8n Content-Type Confusion Arbitrary File Read to RCE (CVE-2026-21858)
Vulhub vulnerability labs
ResearchEvidence observed: Sep 25, 2026Revision: 9b90d4276f84Related tool
Declared conditions
- lab image version: vulhub/n8n:1.65.0(n8n/CVE-2026-21858/docker-compose.yml:services.n8n.image)
n8n Webhooks - Remote Code ExecutionTemplate
http/cves/2026/CVE-2026-21858.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl,status,word($.matchers[*].type)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.