---

📖 Table of Contents

• Overview
• Technical Details
• Severity & CVSS
• Affected Versions
• Impact
• Exploitation
• Detection
• Remediation
• Mitigation
• Summary

---

🔎 Overview

CVE-2026-21858, nicknamed “Ni8mare,” is a critical vulnerability discovered in n8n — a popular platform for building automation workflows (e.g., automating API calls, integrations, SaaS connectors).

It allows unauthenticated remote attackers to interact with improperly validated webhook/form endpoints and gain unauthorized access to files and internal server resources.

A successful exploit can lead to full remote code execution (RCE) and complete instance takeover.

---

🧠 Technical Details

• Root Cause: Improper input validation and Content-Type confusion in webhook/form handling logic.
• Attackers can send crafted HTTP requests that trick the system into exposing file contents or triggering unsafe workflows.
• The flaw allows attackers to:
  • Read arbitrary files from the host
  • Expose sensitive credentials and tokens
  • Forge admin session tokens
  • Abuse workflow nodes (e.g., Execute Command) to run arbitrary OS commands
  • Fully compromise the server instance

---

📊 Severity & CVSS

This represents the maximum possible severity for a remote code execution flaw.

---

📦 Affected Versions

The vulnerability impacts the open-source n8n platform:

= 1.65.0 and < 1.121.0

id="vsurvey1"

All self-hosted instances running versions prior to 1.121.0 are vulnerable.

---

🔥 Impact

An attacker exploiting this vulnerability can:

• 🔓 Read arbitrary system files
• 🔑 Expose database credentials, API keys, tokens
• 🔐 Forge authentication sessions
• 🛠 Execute arbitrary system commands
• 💥 Fully compromise the host machine
• ↔ Pivot into connected systems and integrations

Instances exposed on the public internet are particularly at risk.

---

🧨 Exploitation

This vulnerability is:

• Remote: No network restrictions needed beyond access to webhook/form endpoints
• Unauthenticated: No login or credentials required
• Low complexity: Easy for attackers to craft exploit requests

Evidence from internet scanning suggests tens of thousands of potentially exposed instances remain reachable online.

---

🔍 Detection

Watch for:

• Unexpected HTTP requests with unusual Content-Type headers
• Access patterns to webhook/form endpoints from untrusted sources
• Suspicious file access or node execution logs
• Webserver logs showing abnormal workflow executions

---

🛠 Remediation

✅ Patch Immediately

Update n8n to version 1.121.0 or later — this release includes the fix for CVE-2026-21858.

1. Stop your current n8n instance
2. Upgrade to 1.121.0+
3. Restart the service
4. Validate there are no exposed unpatched nodes remaining

---

🧱 Temporary Mitigation (If Patch Delayed)

While updating, reduce exposure:

• Restrict external access to webhook and form endpoints
• Require authentication for all incoming requests
• Use firewall rules to limit inbound traffic
• Disable public webhooks until patched

---

🔐 Security Checklist

• Run n8n ≥ 1.121.0
• Restrict network access to trusted IPs
• Rotate all stored secrets (API keys/tokens/credentials)
• Review workflow definitions for unsafe content
• Audit access logs for exploit attempts

---

📌 Summary

---

⚠️ Final Advisory

If you run n8n **anywhere — especially self-hosted, internet-facing instances — patch **to version 1.121.0 or higher immediately. The risk of full system compromise is high, and automated exploits are possible given the public details of this issue.