Critical Vulnerability Exposes n8n Instances to Takeover Attacks

SecurityWeek reports a critical vulnerability in the n8n workflow automation platform, tracked as CVE-2026-21858 with a CVSS score of 10, enabling remote code execution without authentication. The flaw affects the platform’s webhook and file-handling logic and could lead to unauthenticated access to arbitrary files, potentially allowing takeover of vulnerable instances.

According to Cyera Research Labs researcher Dor Attias, the issue stems from Content-Type confusion that can cause n8n to call the wrong parser when content type is altered, enabling an attacker to control the _filepath parameter and copy local files. The exploit can be used to load internal files, and can be further leveraged for code execution, including loading the database and configuration to forge a session and log in as administrator.

The vulnerability was addressed in n8n version 1.121.0, released on 18 November 2025, and SecurityWeek notes that all internet-facing n8n instances are at risk and should be patched promptly, with a temporary mitigation of restricting publicly accessible webhook and form endpoints.