bgarz929/ashwesker-cve-2026-21858Exploit for CVE-2026-21858, a critical unauthenticated content-type parsing flaw in n8n allowing arbitrary file read, credential theft, and remote code execution.
| Field | Details |
|---|
| CVE ID | CVE-2026-21858 |
| Codename | Ni8mare |
| Severity | 🔴 Critical |
| CVSS Score | 10.0 (Maximum) |
| Attack Vector | 🌐 Network |
| Authentication Required | ❌ None |
| User Interaction | ❌ None |
| Disclosure Date | January 7, 2026 |
⚠️ Public-facing n8n instances are especially at risk.
CVE-2026-21858 is caused by a content-type parsing flaw in n8n’s handling of incoming HTTP requests—particularly those involving webhooks and form submissions.
Improper validation of the HTTP Content-Type header
Incorrect distinction between:
multipart/form-data
Attackers can manipulate internal request variables (e.g. req.body.files) and bypass security controls.
Without authentication, attackers can:
✅ Read arbitrary files from the server ✅ Extract credentials, secrets, tokens, and configs ✅ Access database files ✅ Forge admin sessions ✅ Escalate to Remote Code Execution (RCE) ✅ Achieve full system takeover
🧨 A single crafted HTTP request can be enough.
Crafted HTTP Request
↓
Content-Type Manipulation
↓
File Handling Bypass
↓
Arbitrary File Read
↓
Credential / Secret Extraction
↓
Privilege Escalation
↓
Remote Code Execution
| Security Property | Impact |
|---|---|
| Confidentiality | 🔥 Complete compromise |
| Integrity | 🔥 Full manipulation possible |
| Availability | 🔥 Potential total disruption |
| Exploit Complexity | ⚡ Low |
| Exposure | 🌍 Internet-facing |
📊 Hundreds of thousands of n8n instances may be exposed worldwide.
Upgrade n8n
Restrict Access
Audit Webhooks
Monitor Logs
❌ No safe workaround exists — patching is mandatory.
Look for: