🔒 Ni8mare Scanner

Ethical Security Scanner for CVE-2026-21858 (Ni8mare Vulnerability)

"Knowledge is power, but only if shared responsibly."

Comprehensive vulnerability detection tool for n8n workflow automation instances. Detects the critical CVE-2026-21858 vulnerability (CVSS 10.0) without performing any exploitation.

⚡ Quick Start

# Navigate to scripts directory
cd ni8mare-scanner/scripts

# Install dependencies
pip install -r requirements.txt

# Check if a version is vulnerable
python n8n_scanner.py version-check 1.120.0

# Scan a live instance
python n8n_scanner.py scan https://n8n.example.com:5678

# Get CVE information
python n8n_scanner.py info

🎯 CVE-2026-21858 Overview

Severity: CVSS 10.0 (Critical)
Fixed In: n8n v1.121.0
Discovered By: Dor Attias (Cyera Research Labs)
Tool Maintained By: CropNet on GitHub, by Schema.cx organisation research team

Critical vulnerability allowing unauthenticated attackers to read arbitrary files through Content-Type confusion.

This scanner performs non-invasive detection only - never exploits the vulnerability.

✨ Features

• ✅ Version Detection - Automatically identifies n8n version and checks vulnerability status
• ✅ Multiple Scan Modes - Light, medium, and deep scan intensities
• ✅ Batch Scanning - Scan multiple targets from a file
• ✅ Flexible Output - JSON, CSV, HTML, Markdown, or plain text reports
• ✅ Rate Limiting - Configurable delays to respect target systems
• ✅ Authorization Checks - Interactive confirmation for compliance
• ✅ Ethical Design - Non-exploitative detection only

📖 Usage Examples

Check a Specific Version

# Check vulnerable version
python n8n_scanner.py version-check 1.120.0
# Output: Status 🔴 VULNERABLE (exit code 2)

# Check safe version
python n8n_scanner.py version-check 1.121.0
# Output: Status 🟢 Not Vulnerable (exit code 0)

Scan a Live Instance

# Basic scan
python n8n_scanner.py scan https://n8n.example.com:5678

# Deep scan with JSON output
python n8n_scanner.py scan https://n8n.example.com:5678 \
  --intensity deep \
  --format json \
  --output report.json

# Skip authorization prompt (for pre-authorized scans)
python n8n_scanner.py scan https://n8n.example.com:5678 --no-confirm

Batch Scanning Multiple Targets

# Create targets file
cat > targets.txt << EOF
https://n8n1.example.com:5678
https://n8n2.example.com:5678
https://n8n3.example.com:5678
EOF

# Scan all targets
python n8n_scanner.py batch targets.txt --output results.csv --format csv

Generate Configuration

# Generate YAML config to stdout
python n8n_scanner.py generate-config --format yaml

# Generate JSON config to file
python n8n_scanner.py generate-config --format json --output config.json

# Use config file for scanning
python n8n_scanner.py scan https://n8n.example.com:5678 --config config.json

🎮 Available Commands

Command	Description	Example
scan	Scan a single target	python n8n_scanner.py scan <target>
batch	Scan multiple targets	python n8n_scanner.py batch targets.txt
version-check	Check version vulnerability	python n8n_scanner.py version-check 1.120.0
generate-config	Generate config template	python n8n_scanner.py generate-config --format yaml
info	Display CVE information	python n8n_scanner.py info
connectivity	Test connectivity	python n8n_scanner.py connectivity <target>

Command Options

scan Command

python n8n_scanner.py scan <target> [OPTIONS]

Options:

• --intensity, -i - Scan intensity: light, medium, deep (default: medium)
• --output, -o - Output file path
• --format, -f - Output format: json, csv, html, text, markdown
• --timeout, -t - Request timeout in seconds (default: 30)
• --delay, -d - Delay between requests (default: 2.0)
• --no-confirm - Skip authorization confirmation
• --config, -c - Configuration file path
• --verbose, -V - Verbose output
• --json-logs - JSON log format (for automation)

version-check Command

python n8n_scanner.py version-check <version_or_url>

Exit Codes:

• 0 - Version is safe (patched)
• 1 - Error occurred
• 2 - Version is vulnerable

Examples:

# Check version string
python n8n_scanner.py version-check 1.120.0

# Check live instance version
python n8n_scanner.py version-check https://n8n.example.com:5678

⚙️ Configuration

Configuration File Format

# config.yml
scan:
  intensity: medium
  timeout: 30
rate_limit:
  delay: 2.0
  max_requests: 100
targets:
  - https://n8n.example.com:5678
require_confirmation: true
output:
  format: json
  directory: ./reports

Scan Profiles

Four pre-configured profiles available:

• quick - Light intensity, 15s timeout, 1s delay
• standard - Medium intensity, 30s timeout, 2s delay (default)
• thorough - Deep intensity, 60s timeout, 3s delay
• compliance - Deep intensity, 60s timeout, 5s delay, detailed logging

Generate with: python n8n_scanner.py generate-config --profile thorough

📊 Output Formats

JSON (Machine-Readable)

{
  "target": "https://n8n.example.com:5678",
  "version": "1.120.0",
  "vulnerable": true,
  "cve": "CVE-2026-21858",
  "severity": "CRITICAL"
}

CSV (Spreadsheet)

Target,Version,Vulnerable,CVE,Severity
https://n8n.example.com:5678,1.120.0,true,CVE-2026-21858,CRITICAL

HTML (Reports)

Professional HTML reports with styling and charts.

Text (Terminal)

Color-coded human-readable output with severity indicators.

Markdown (Documentation)

Documentation-friendly format for wikis and reports.

🐳 Docker Support

# Build with Docker Compose
docker-compose build

# Run commands
docker-compose run --rm scanner version-check 1.120.0
docker-compose run --rm scanner scan https://n8n.example.com:5678 --no-confirm

# Batch scan with mounted file
docker-compose run --rm \
  -v $(pwd)/targets.txt:/app/targets.txt \
  scanner batch /app/targets.txt

🔧 Development

Project Structure

ni8mare-scanner/
├── scripts/
│   ├── n8n_scanner.py          # Main CLI
│   ├── modules/                # Core modules
│   │   ├── scanner.py          # Scanning logic
│   │   ├── detector.py         # Vulnerability detection
│   │   ├── reporter.py         # Report generation
│   │   ├── config.py           # Configuration
│   │   └── utils.py            # Utilities
│   ├── tests/                  # Test suite
│   └── build.py                # Build automation
├── docs/                       # Documentation
└── docker/                     # Docker configs

Running Tests

# Quick functionality test (recommended)
cd scripts
python quick_test.py

# Full test suite
python build.py test

# Test specific module
python -m pytest tests/test_config.py -v

Quick Test Results:

[Test] Version Vulnerability Detection  [OK]
[Test] Configuration Loading            [OK]
[Test] Scanner Creation                 [OK]
[Test] Detector Creation                [OK]
[Test] Reporter Creation                [OK]
[Test] Utility Functions                [OK]

Results: 6 passed, 0 failed

Build Automation

# Install dependencies
python build.py install

# Run all tests
python build.py test

# Run linters
python build.py lint

# Format code
python build.py format

# Build distribution
python build.py build

# Clean artifacts
python build.py clean