Public Exploit Released: Critical n8n Flaw CVE-2026-21858 Exposes 100k Servers

Public Exploit Released: Critical n8n Flaw CVE-2026-21858 Exposes 100k Servers has highlighted a logic error in how n8n processes incoming HTTP requests, described as a Content-Type Confusion that can let unauthenticated attackers seize full control of a server. According to Cyera, the vulnerability, tracked as CVE-2026-21858, carries a CVSS score of 10.0 and impacts an estimated 100,000 servers globally, with threat actors able to read internal files and potentially take over the server.

The flaw lies in the Form Webhook Node’s handling of uploads, where a maliciously crafted JSON payload can trick the system into exposing files like /etc/passwd, enabling an Arbitrary File Read and, when chained with other flaws, unauthenticated Remote Code Execution. The article notes that a Proof-of-Concept exploit chain is already public and recommends administrators upgrade to n8n version 1.121.0 or later and ensure instances are not publicly exposed without authentication.

The risk is described as massive due to n8n’s role in connecting disparate systems, potentially exposing API keys, databases and proprietary AI workflows.