Cybersecurity researchers have unveiled a critical vulnerability, CVE-2026-21858, a maximum-severity flaw in the widely-used n8n workflow automation platform. This security loophole, codenamed Ni8mare, allows unauthenticated remote attackers to gain complete control over vulnerable n8n instances by exploiting a Content-Type confusion. The discovery, attributed to security researcher Dor Attias and reported by Cyera Research Labs, highlights significant risks associated with the platform’s security posture.
The vulnerability has a CVSS score of 10.0, indicating its extreme severity. n8n acknowledged the issue in an advisory, stating that a susceptible workflow could grant an unauthenticated remote attacker access to sensitive information and potentially enable further system compromise. This latest discovery follows a series of critical vulnerabilities reported in n8n over the past two weeks, underscoring a concerning trend.
n8n Faces Mounting Security Concerns with Critical Vulnerabilities
The recent disclosure of CVE-2026-21858, also known as Ni8mare, places n8n under intense scrutiny. Unlike previously disclosed flaws that required authentication and involved remote code execution or sandbox bypasses, Ni8mare allows for complete instance compromise without any credentials. The vulnerability directly impacts the platform’s file and webhook handling mechanisms, presenting a significant threat to users who rely on n8n for automating critical business processes.
n8n has been actively addressing these vulnerabilities. Previous critical flaws included CVE-2025-68613 (CVSS 9.9), an improper control of dynamically-managed code resources allowing authenticated remote code execution, fixed in versions 1.120.4, 1.121.1, and 1.122.0. Another, CVE-2025-68668, dubbed N8scape (CVSS 9.9), was a sandbox bypass enabling authenticated users to execute arbitrary commands, patched in version 2.0.0. A third, CVE-2026-21877 (CVSS 10.0), involved a dangerous file upload type that allowed authenticated attackers to execute untrusted code, fixed in version 1.121.3.
How CVE-2026-21858 Leverages Content-Type Confusion
According to technical details released by Cyera, the Ni8mare vulnerability stems from how n8n processes incoming requests, particularly through its webhook and file handling functionalities. The platform uses a function, `parseRequestBody()`, to interpret the “Content-Type” header of incoming requests. Based on this header, it directs the request to either `parseFormData()` (for “multipart/form-data”) or `parseBody()` (for all other content types).
The issue arises when a file-handling function, specifically `copyBinaryFile()`, is invoked without first validating that the “Content-Type” header is indeed “multipart/form-data.” This procedural oversight allows an attacker to manipulate the `req.body.files` object. As security researcher Dor Attias explained, this control over `req.body.files` means an attacker can alter parameters like the filepath. Instead of copying an uploaded file, they can trick the system into copying any local file from the server.
The consequence is that subsequent processes within the workflow, such as those triggered by a “Form” node, will receive the content of an arbitrary local file as if it were user-uploaded data. This primitive allows for sensitive information disclosure and can be escalated to arbitrary command execution.
A potential attack scenario described involves a website using an n8n Form workflow to manage product specification files for a chat interface. An attacker could exploit CVE-2026-21858 to read sensitive files, such as the n8n database located at `/home/node/.n8n/database.sqlite`. The extracted administrator credentials, then combined with reading the encryption secret key from `/home/node/.n8n/config`, could allow the attacker to forge an administrator session cookie, bypassing authentication and gaining administrative access.
This administrative access would then enable the attacker to create a new workflow with an “Execute Command” node, achieving full remote code execution and complete compromise of the n8n instance. Cyera emphasized the significant “blast radius” of a compromised n8n instance, stating it centralizes critical assets like API credentials, OAuth tokens, and database connections, making it a prime target for threat actors and a catastrophic single point of failure.
In response to this critical vulnerability, users are strongly advised to upgrade to n8n version 1.121.0 or later without delay. As immediate protective measures, users should avoid exposing n8n instances to the public internet and enforce authentication for all Forms. Temporary workarounds include restricting or disabling publicly accessible webhook and form endpoints until updates can be applied.
The ongoing series of high-severity vulnerabilities in n8n highlights the importance of continuous security auditing and prompt patching for workflow automation platforms. Organizations relying on n8n will be closely monitoring future advisories and updates from the developers to ensure the continued security of their automated processes.