Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

According to Cyera Research Labs, researchers disclosed a maximum-severity flaw in n8n, tracked as CVE-2026-21858 with a CVSS score of 10.0, named Ni8mare, which allows an unauthenticated remote attacker to gain full control of vulnerable instances.

The issue arises from a Content-Type confusion flaw in the n8n webhook and file handling, where a file-handling function can be run without verifying that the content type is multipart/form-data, enabling an attacker to override req.body[.]files and potentially execute arbitrary commands on the server.

Cyera says the vulnerable flow exists in the formWebhook() function, which calls copyBinaryFile() to act on req.body[.]files, and that an attacker could read arbitrary files, forge a session, bypass authentication and achieve RCE by creating a new workflow with an Execute Command node. The vulnerability affects all versions prior to and including 1.65.0, with a patch in version 1.121.0 released on 18 November 2025; newer releases are 1.123.10, 2.1.5, 2.2.4, and 2.3.0.

The Hacker News cautions users to upgrade promptly, restrict or disable publicly accessible webhook and form endpoints, and ensure authentication for all Forms. 7 January 2026