Ni8mare flaw gives unauthenticated control of n8n instances

According to Cyera researchers who discovered the vulnerability, Ni8mare is a critical flaw in n8n trackable as CVE-2026-21858 with a CVSS of 10.0, allowing unauthenticated attackers to fully compromise affected instances. The issue affects all versions of n8n prior to and including 1.65.0 and was fixed in version 1.121.0 in November 2025.

It stems from how n8n Webhooks process uploaded data, where some file-handling workflows do not verify Content-Type before processing files, enabling an unauthenticated remote attacker to define req.body[.]files. By manipulating the Content-Type, an attacker can trick n8n into copying arbitrary local files and exposing them through downstream nodes, potentially leading to arbitrary file read.

With an initial arbitrary file read, the attacker can extract the local SQLite database and the signing secret from the config file to forge a valid admin session cookie, bypass authentication, and then use the Execute Command node to achieve remote code execution on the n8n instance. The report notes that “The blast radius of a compromised n8n is massive,” emphasising that API credentials, OAuth tokens, and other centralised data could be exposed.