Ni8mare Flaw in n8n: What Defenders Need to Know About CVE-2026-21858

Security researchers disclosed Ni8mare, a maximum-severity vulnerability tracked as CVE-2026-21858 in n8n, which allows an unauthenticated attacker to fully compromise vulnerable deployments. CVE-2026-21858 carries a CVSS score of 10.0 and can enable arbitrary file reads, authentication bypass, and ultimately remote code execution, a risk heightened by n8n’s frequent storage of API keys, OAuth tokens, and other credentials.

All n8n versions up to and including 1.65.0 are affected, and the flaw was fixed in version 1.121.0, released in November 2025; upgrading beyond this fixed release is strongly recommended, with no official workaround offering complete mitigation. The issue arises from a mismatch in how n8n parses incoming HTTP requests and how some workflows handle uploaded files, enabling an attacker to craft non-file content that mimics the structure of uploaded files and control internal file references.

This effectively turns Form-based workflows into an arbitrary file read primitive, potentially exposing secrets, configuration data, and credentials that could facilitate full system takeover, including forged administrator sessions. Immediate steps include upgrading to 1.121.0 or later, avoiding internet exposure of n8n instances, enforcing authentication on all Forms and webhook endpoints, and reviewing file-upload workflows, according to Cyera Research Labs.