⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More

Summary: A maximum-severity vulnerability in the n8n workflow automation platform, tracked as CVE-2026-21858 and called Ni8mare, allows unauthenticated remote code execution on locally deployed instances running versions prior to 1.121.0. The flaw arises in form-based workflows where file-handling functions run without validating that a request was processed as multipart/form-data, letting a crafted request reach arbitrary file paths on the host and potentially escalate to code execution. As of January 11, 2026, about 59,500 internet-exposed hosts remained vulnerable, with more than 27,000 IP addresses in the U.S. and over 21,200 in Europe.
What you should know: Horizon3.ai notes exploitation requires a publicly accessible, unauthenticated n8n form workflow plus a way to retrieve local files from the server, but roughly 59,500 exposed hosts still carry the flaw, and Field Effect describes the worst case as full system compromise and unauthorized access to connected services.

Read the original at The Hacker News ↗