Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control
Summary: Researchers disclosed CVE-2026-21858, a CVSS 10.0 flaw in the n8n workflow automation platform codenamed Ni8mare, which lets an unauthenticated remote attacker take complete control of susceptible instances by exploiting a Content-Type confusion in the webhook and file-handling mechanism. The flaw affects all versions up to and including 1.65.0 and was fixed in version 1.121.0, released November 18, 2025, after researcher Dor Attias reported it on November 9, 2025.
What you should know: Censys counts 26,512 exposed n8n hosts, and a compromised instance hands attackers the API credentials, OAuth tokens, database connections, and cloud storage centralized inside it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-21858
- Related