🔒 Ni8mare Scanner

Ethical Security Scanner for CVE-2026-21858 (Ni8mare Vulnerability)

"Knowledge is power, but only if shared responsibly."

Comprehensive vulnerability detection tool for n8n workflow automation instances. Detects the critical CVE-2026-21858 vulnerability (CVSS 10.0) without performing any exploitation.

⚡ Quick Start

# Navigate to scripts directory
cd ni8mare-scanner/scripts

# Install dependencies
pip install -r requirements.txt

# Check if a version is vulnerable
python n8n_scanner.py version-check 1.120.0

# Scan a live instance
python n8n_scanner.py scan https://n8n.example.com:5678

# Get CVE information
python n8n_scanner.py info

🎯 CVE-2026-21858 Overview

Severity: CVSS 10.0 (Critical)
Fixed In: n8n v1.121.0
Discovered By: Dor Attias (Cyera Research Labs)
Tool Maintained By: CropNet on GitHub, by Schema.cx organisation research team

Critical vulnerability allowing unauthenticated attackers to read arbitrary files through Content-Type confusion.

This scanner performs non-invasive detection only - never exploits the vulnerability.

✨ Features

• ✅ Version Detection - Automatically identifies n8n version and checks vulnerability status
• ✅ Multiple Scan Modes - Light, medium, and deep scan intensities
• ✅ Batch Scanning - Scan multiple targets from a file
• ✅ Flexible Output - JSON, CSV, HTML, Markdown, or plain text reports
• ✅ Rate Limiting - Configurable delays to respect target systems
• ✅ Authorization Checks - Interactive confirmation for compliance
• ✅ Ethical Design - Non-exploitative detection only

📖 Usage Examples

Check a Specific Version

# Check vulnerable version
python n8n_scanner.py version-check 1.120.0
# Output: Status 🔴 VULNERABLE (exit code 2)

# Check safe version
python n8n_scanner.py version-check 1.121.0
# Output: Status 🟢 Not Vulnerable (exit code 0)

Scan a Live Instance

# Basic scan
python n8n_scanner.py scan https://n8n.example.com:5678

# Deep scan with JSON output
python n8n_scanner.py scan https://n8n.example.com:5678 \
  --intensity deep \
  --format json \
  --output report.json

# Skip authorization prompt (for pre-authorized scans)
python n8n_scanner.py scan https://n8n.example.com:5678 --no-confirm

Batch Scanning Multiple Targets

# Create targets file
cat > targets.txt << EOF
https://n8n1.example.com:5678
https://n8n2.example.com:5678
https://n8n3.example.com:5678
EOF

# Scan all targets
python n8n_scanner.py batch targets.txt --output results.csv --format csv

Generate Configuration

# Generate YAML config to stdout
python n8n_scanner.py generate-config --format yaml

# Generate JSON config to file
python n8n_scanner.py generate-config --format json --output config.json

# Use config file for scanning
python n8n_scanner.py scan https://n8n.example.com:5678 --config config.json

🎮 Available Commands

Command Options

scan Command

python n8n_scanner.py scan <target> [OPTIONS]

Options:

• --intensity, -i - Scan intensity: light, medium, deep (default: medium)
• --output, -o - Output file path
• --format, -f - Output format: json, csv, html, text, markdown
• --timeout, -t - Request timeout in seconds (default: 30)
• --delay, -d - Delay between requests (default: 2.0)
• --no-confirm - Skip authorization confirmation
• - Configuration file path

version-check Command

python n8n_scanner.py version-check <version_or_url>

Exit Codes:

• 0 - Version is safe (patched)
• 1 - Error occurred
• 2 - Version is vulnerable

Examples:

# Check version string
python n8n_scanner.py version-check 1.120.0

# Check live instance version
python n8n_scanner.py version-check https://n8n.example.com:5678

⚙️ Configuration

Configuration File Format

# config.yml
scan:
  intensity: medium
  timeout: 30
rate_limit:
  delay: 2.0
  max_requests: 100
targets:
  - https://n8n.example.com:5678
require_confirmation: true
output:
  format: json
  directory: ./reports

Scan Profiles

Four pre-configured profiles available:

• quick - Light intensity, 15s timeout, 1s delay
• standard - Medium intensity, 30s timeout, 2s delay (default)
• thorough - Deep intensity, 60s timeout, 3s delay
• compliance - Deep intensity, 60s timeout, 5s delay, detailed logging

Generate with: python n8n_scanner.py generate-config --profile thorough

📊 Output Formats

JSON (Machine-Readable)

{
  "target": "https://n8n.example.com:5678",
  "version": "1.120.0",
  "vulnerable": true,
  "cve": "CVE-2026-21858",
  "severity": "CRITICAL"
}

CSV (Spreadsheet)

Target,Version,Vulnerable,CVE,Severity
https://n8n.example.com:5678,1.120.0,true,CVE-2026-21858,CRITICAL

HTML (Reports)

Professional HTML reports with styling and charts.

Text (Terminal)

Color-coded human-readable output with severity indicators.

Markdown (Documentation)

Documentation-friendly format for wikis and reports.

🐳 Docker Support

# Build with Docker Compose
docker-compose build

# Run commands
docker-compose run --rm scanner version-check 1.120.0
docker-compose run --rm scanner scan https://n8n.example.com:5678 --no-confirm

# Batch scan with mounted file
docker-compose run --rm \
  -v $(pwd)/targets.txt:/app/targets.txt \
  scanner batch /app/targets.txt

🔧 Development

Project Structure

ni8mare-scanner/
├── scripts/
│   ├── n8n_scanner.py          # Main CLI
│   ├── modules/                # Core modules
│   │   ├── scanner.py          # Scanning logic
│   │   ├── detector.py         # Vulnerability detection
│   │   ├── reporter.py         # Report generation
│   │   ├── config.py           # Configuration
│   │   └── utils.py            # Utilities
│   ├── tests/                  # Test suite
│   └── build.py                # Build automation
├── docs/                       # Documentation
└── docker/                     # Docker configs

Running Tests

# Quick functionality test (recommended)
cd scripts
python quick_test.py

# Full test suite
python build.py test

# Test specific module
python -m pytest tests/test_config.py -v

Quick Test Results:

[Test] Version Vulnerability Detection  [OK]
[Test] Configuration Loading            [OK]
[Test] Scanner Creation                 [OK]
[Test] Detector Creation                [OK]
[Test] Reporter Creation                [OK]
[Test] Utility Functions                [OK]

Results: 6 passed, 0 failed

Build Automation

# Install dependencies
python build.py install

# Run all tests
python build.py test

# Run linters
python build.py lint

# Format code
python build.py format

# Build distribution
python build.py build

# Clean artifacts
python build.py clean

# Full build pipeline
python build.py all

🔒 Security & Ethics

Authorization Required

The scanner requires explicit authorization:

⚠️  AUTHORIZATION REQUIRED

You are about to scan: https://n8n.example.com:5678

Are you authorized to test this target? [y/N]:

Ethical Use Policy

Required:

• ✅ Obtain written authorization before scanning
• ✅ Use only for legitimate security assessments
• ✅ Report findings responsibly
• ✅ Respect rate limits and target systems

Prohibited:

• ❌ Unauthorized scanning or access attempts
• ❌ Exploiting detected vulnerabilities
• ❌ Causing service disruption
• ❌ Public disclosure without coordination

Responsible Disclosure

If you discover vulnerable instances:

1. Do NOT exploit the vulnerability
2. Contact the organization privately
3. Provide remediation guidance (upgrade to 1.121.0+)
4. Allow reasonable time for patching (90 days recommended)
5. Coordinate disclosure before publishing

🙏 Attribution

CVE Discovery

CVE-2026-21858 discovered by:

• Researcher: Dor Attias
• Organization: Cyera Research Labs
• Disclosure: January 2024

Scanner Development

This scanner was developed as an ethical security tool to help organizations identify and remediate the Ni8mare vulnerability. It performs detection only and never exploits vulnerabilities.

📝 License

MIT License - See LICENSE file for details.

Third-Party Components:

• requests (Apache 2.0), click (BSD 3-Clause), pydantic (MIT), pyyaml (MIT), jinja2 (BSD 3-Clause)

📞 Support

• Bug Reports: Open an issue on GitHub
• Feature Requests: Label with enhancement
• Security Issues: Report privately via email

❓ FAQ

Q: Will this exploit the vulnerability?
A: No. Detection only, never exploits.

Q: Can I scan without authorization?
A: No. Always obtain written authorization first.

Q: What versions are vulnerable?
A: All n8n versions below 1.121.0 are vulnerable.

Q: How accurate is the detection?
A: Very high accuracy with low false-positive rates.

Q: Can I use this in CI/CD pipelines?
A: Yes. Use --no-confirm and --json-logs for automation.

Q: Does it work on Windows?
A: Yes. All Unicode compatibility issues have been resolved.

🎯 Quick Reference

Installation

cd ni8mare-scanner/scripts
pip install -r requirements.txt

Common Commands

# Version check
python n8n_scanner.py version-check 1.120.0

# Scan instance
python n8n_scanner.py scan https://n8n.example.com:5678

# Batch scan
python n8n_scanner.py batch targets.txt

# Generate config
python n8n_scanner.py generate-config --format yaml > config.yml

# Show help
python n8n_scanner.py --help
python n8n_scanner.py scan --help

Exit Codes

• 0 = Safe/Success
• 1 = Error
• 2 = Vulnerable

Made with ❤️ for the security community

This tool is provided as-is for ethical security testing only. The authors are not responsible for misuse or damage caused by this tool.