CVE-2026-21858

n8n Workflow Automation Platform - Remote Code Execution

A security research tool for detecting CVE-2026-21858, a critical remote code execution vulnerability in the n8n workflow automation platform.

---

Table of Contents

• Vulnerability Summary
• Affected Versions
• Technical Analysis
• Prerequisites
• Installation
• Usage
• Output Reference
• Detection Methodology
• Mitigation and Remediation
• Indicators of Compromise
• Legal Disclaimer
• References
• Credits

---

Vulnerability Summary

Field	Value
CVE Identifier	CVE-2026-21858
CVSS v3.1 Score	10.0 (Critical)
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE Classification	CWE-94: Improper Control of Generation of Code
Vendor	n8n GmbH
Product	n8n Workflow Automation
Disclosure Date	January 2026
Patch Available	Yes (v1.121.0+)

Executive Summary

A critical vulnerability exists in n8n versions 1.65.0 through 1.120.x that allows unauthenticated remote attackers to execute arbitrary code on the underlying server. The vulnerability is exploited through specially crafted form-based workflows, enabling unauthorized file system access and command execution.

Impact Assessment

• Confidentiality: Complete compromise of system data
• Integrity: Arbitrary file modification and code execution
• Availability: Potential for complete system takeover or denial of service
• Scope: Changed - exploitation may affect resources beyond the vulnerable component

---

Affected Versions

Version Range	Status
< 1.65.0	Not Affected
1.65.0 - 1.120.x	Vulnerable
>= 1.121.0	Patched

---

Technical Analysis

Vulnerability Root Cause

The vulnerability originates from insufficient input validation in the form-based workflow execution engine. When processing user-supplied data through form triggers, n8n fails to properly sanitize input parameters before passing them to internal execution contexts.

Attack Vector

1. Attacker identifies a publicly accessible n8n instance
2. Exploitation targets form-based workflow endpoints
3. Malicious payloads are injected through form input fields
4. The payload executes with the privileges of the n8n service account
5. Arbitrary file read/write and command execution are achieved

Exploitation Complexity

• Prerequisites: Network access to target n8n instance
• Authentication: Not required
• User Interaction: None
• Attack Complexity: Low

---

Prerequisites

System Requirements

• Python 3.12 or higher
• Network connectivity to target n8n instance(s)
• Sufficient permissions to execute Python scripts

Dependencies

Package	Minimum Version	Purpose
requests	2.31.0	HTTP request handling
urllib3	2.0.0	URL and connection management
packaging	23.0	Version comparison logic

---

Installation

Method 1: Using uv (Recommended)

uv is a fast Python package installer and resolver.

# Clone the repository
git clone https://github.com/sh4den/CVE-2026-21858.git
cd CVE-2026-21858

# Install dependencies and create virtual environment
uv sync

# Run the tool
uv run python main.py -u https://target.example.com

Method 2: Using pip

# Clone the repository
git clone https://github.com/sh4den/CVE-2026-21858.git
cd CVE-2026-21858

# Create virtual environment (recommended)
python3 -m venv venv
source venv/bin/activate  # Linux/macOS
# or
.\venv\Scripts\activate   # Windows

# Install dependencies
pip install requests>=2.31.0 urllib3>=2.0.0 packaging>=23.0

# Run the tool
python main.py -u https://target.example.com

Method 3: Manual Installation

# Ensure Python 3.12+ is installed
python3 --version

# Install required packages
pip install requests urllib3 packaging

# Download and run
curl -O https://raw.githubusercontent.com/sh4den/CVE-2026-21858/main/main.py
python3 main.py -u https://target.example.com

---

Usage

Command Line Interface

Usage:
    python main.py -u <target_url>        Scan single target
    python main.py -l <targets_file>      Scan multiple targets from file

Arguments:
    -u    Single target URL
    -l    Path to file containing target URLs (one per line)

Single Target Scan

Test a single n8n instance for the vulnerability:

python main.py -u https://n8n.example.com

python main.py -u http://192.168.1.100:5678

Bulk Target Scan

Scan multiple targets from a file:

python main.py -l targets.txt

Target File Format (targets.txt):

https://n8n.company-a.com
https://n8n.company-b.com:5678
http://10.0.0.50:5678
n8n.company-c.com
192.168.1.100:5678

Notes:

• One target per line
• URLs without a protocol prefix default to https://
• Empty lines are ignored
• Targets are scanned concurrently using threading

---

Output Reference

Status Indicators

Indicator	Color	Description
[VULNERABLE]	Green	Target runs a vulnerable n8n version (1.65.0 - 1.120.x)
[SAFE]	Blue	Target runs a patched version (>= 1.121.0 or < 1.65.0)
[WARNING]	Yellow	n8n instance detected but version extraction failed
[ERROR]	Red	Connection failure, timeout, or non-n8n target

Detection Methodology

Version Fingerprinting Process

The tool employs passive version detection through the following steps:

1. Endpoint Request: HTTP GET request to /signin endpoint
2. Instance Verification: Validates target is an n8n installation
3. Configuration Extraction: Locates n8n:config:sentry meta tag in HTML
4. Base64 Decoding: Decodes the embedded Sentry configuration
5. Version Parsing: Extracts version string matching pattern [email protected]
6. Vulnerability Assessment: Compares extracted version against known vulnerable range

Request Details

GET /signin HTTP/1.1
Host: target.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9
Accept-Language: en-US,en;q=0.5
Connection: close

---

Mitigation and Remediation

Immediate Actions

1. Upgrade n8n: Update to version 1.121.0 or later immediately

   # Using npm
   npm update -g n8n
   
   # Using Docker
   docker pull n8nio/n8n:latest
   

2. Network Isolation: Restrict access to n8n instances

   • Implement firewall rules limiting access to trusted IP ranges
   • Place n8n behind a VPN or reverse proxy with authentication

3. Workflow Audit: Review all existing workflows

   • Identify and disable form-based workflows temporarily
   • Audit webhook endpoints for unauthorized access

Long-term Recommendations

Action	Priority	Description
Patch Management	Critical	Establish automated update procedures for n8n
Access Control	High	Implement authentication for all n8n endpoints
Network Segmentation	High	Isolate n8n from public networks
Monitoring	Medium	Deploy logging and alerting for n8n activity
Least Privilege	Medium	Run n8n with minimal required permissions
Backup	Medium	Maintain regular backups of workflow configurations

Verification After Patching

# Verify n8n version after update
n8n --version

# Or check via this tool
python main.py -u https://your-n8n-instance.com
# Expected: [SAFE] ... Version: 1.121.0+ (not vulnerable)

---

Indicators of Compromise

Log Analysis