CVE-2026-21858

Published Jan 8, 2026

Last updated 8 months ago

CVSS critical 10.0

n8n

Ni8mare

Chat GPT

Cloud

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-21858, dubbed "Ni8mare" by Cyera Research Labs, is a critical vulnerability found in the n8n workflow automation platform. The flaw stems from a "Content-Type confusion" issue within the `formWebhook()` function, which is responsible for handling form submissions. This function fails to adequately verify that the incoming HTTP request's `Content-Type` header is set to "multipart/form-data" before processing files. This oversight allows an unauthenticated attacker to manipulate the `req.body.files` object by sending specially crafted requests. By exploiting this, an attacker can achieve arbitrary file reads from the n8n server and potentially escalate their access to execute arbitrary commands on the underlying system. The vulnerability affects n8n versions up to and including 1.65.0 and was addressed in version 1.121.0, released on November 18, 2025.

Description: n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
Source: security-advisories@github.com
NVD status: Analyzed
Products: n8n

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 5.8
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "A90AFDBB-31A3-41C0-8E53-8D10D9FB47C3",
            "versionEndExcluding": "1.121.0",
            "versionStartIncluding": "1.65.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.