Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Research-CVE-2026-21858 — Technical analysis and proof-of-concept for CVE-2026-21858, an authentication bypass and RCE in n8n, demonstrating LFI, session forgery, and full system compromise. | Kitploit
Tools/GitHubGitHub/bannt08/research-cve-2026-21858
Vulnerability AnalysisExploitationWeb Application ExploitationAuthenticationRemote Access Trojan
GitHubbannt08/research-cve-2026-21858

Research-CVE-2026-21858

Technical analysis and proof-of-concept for CVE-2026-21858, an authentication bypass and RCE in n8n, demonstrating LFI, session forgery, and full system compromise.

View Repository
3 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

[CVE-2026-21858] Ni8mare: n8n Authentication Bypass & Remote Code Execution

  1. OverviewVulnerability
  • Name: Ni8mare
  • CVE ID: CVE-2026-21858
  • CVSS Score: 10.0 (Critical)
  • Vulnerability Type: Authentication Bypass, Local File Inclusion (LFI), Remote Code Execution (RCE)
  • Affected Versions: n8n versions 1.65.0 and earlier
  • Patch Version: n8n 1.121.0 (Released November 2025)

  1. Vulnerability Description This critical vulnerability allows remote, unauthenticated attackers to gain unauthorized access to server files via form-based workflows. This local file inclusion (LFI) exposes sensitive data and provides a foothold for deeper system penetration.

  2. Technical AnalysisThe Root cause of CVE-2026-21858 lies in the mechanism n8n uses to process webhooks and uploaded data. Mechanism of Failure

    • Content-Type Handling: When receiving an HTTP request, n8n analyzes the content based on the Content-Type header to decide how to process the data.
    • Validation Gap: Certain file handling functions within workflows fail to adequately check the Content-Type before manipulating file data.
    • Variable Manipulation: This oversight allows an attacker to control the variable containing file information and specify arbitrary paths on the system, effectively turning the upload function into an unauthorized local file read mechanism.
    • Vulnerable Logic: In a normal flow, n8n uses Formidable to safely parse multipart/form-data uploads into random temporary paths. However, if an attacker changes the Content-Type to application/json, n8n uses a different parser (parseBody()) that directly populates req.body.files with user-controlled values, including arbitrary file paths.
    • Affected Source Code: The critical flaw is located in packages\nodes-base\nodes\Form\utils\utils.ts.

  • Exploit Chain Researchers have demonstrated a practical exploit chain leading to full system takeover:

    • Database Access: Directly read the n8n database file to extract admin IDs, emails, and hashed passwords.
    • Encryption Key Extraction: Read configuration files to obtain the system's encryption keys.
    • Session Forgery: Forge administrative login sessions using forged cookies.
    • Remote Code Execution (RCE): Once administrative access is gained, the attacker can create new workflows to execute arbitrary commands on the host server.
    • Total Compromise: Complete access leads to the exposure of all stored API keys, OAuth tokens, database connections, and cloud service credentials.

  • PoC

    Target Endpoint: The exploitation typically targets endpoints such as /form/vulnerable-form. alt text

    Results: Successful execution demonstrates the ability to read system files like /etc/passwd, confirming the vulnerability. alt text

    • Download Tool