CVE-2026-21858

critical

Description

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.

References

https://www.infosecurity-magazine.com/news/chinese-hacker-deepseek-ai/

https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/

https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html

https://intezer.com/blog/how-attackers-access-llm-inference/

https://www.labs.greynoise.io/grimoire/2026-03-23-bucklog-k8s/

https://www.theregister.com/2026/03/12/cisa_n8n_rce/

https://www.bleepingcomputer.com/news/security/critical-n8n-flaws-disclosed-along-with-public-exploits/

https://thehackernews.com/2026/01/two-high-severity-n8n-flaws-allow.html

https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-impacts-nearly-60-000-n8n-instances/

https://www.databreachtoday.com/no-rest-in-2026-as-patch-alerts-amass-for-cisco-hpe-n8n-a-30482

https://www.theregister.com/2026/01/08/n8n_rce_bug/

https://www.securityweek.com/critical-vulnerability-exposes-n8n-instances-to-takeover-attacks/

https://www.infosecurity-magazine.com/news/maximum-severity-ni8mare-bug/

https://horizon3.ai/attack-research/attack-blogs/the-ni8mare-test-n8n-rce-under-the-microscope-cve-2026-21858/

https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-lets-hackers-hijack-n8n-servers/

https://thehackernews.com/2026/01/critical-n8n-vulnerability-cvss-100.html

https://securityaffairs.com/186648/security/ni8mare-flaw-gives-unauthenticated-control-of-n8n-instances.html

https://www.tenable.com/blog/the-agentic-ai-threat-cluster-seven-incidents-three-actors-and-what-they-mean

https://github.com/Giangdurian/CVE-2026-21858-and-CVE-2025-68613

https://github.com/qianlijaingshan/n8n-cve-2026-21858

https://github.com/Fomovet/cve-2026-21858

https://github.com/Perufitlife/n8n-security

https://github.com/endiselmanaj/macos-vuln-check

https://github.com/masterwok/PoC-CVE-2026-21858

https://github.com/kaleth4/CVE-2026-21858

https://github.com/bamov970/CVE-2026-21858

https://github.com/zaryouhashraf/CVE-2026-21858

https://github.com/0xAshwesker/CVE-2026-21858

https://github.com/Alhakim88/CVE-2026-21858

https://github.com/NOTTIBOY137/RulesGuard

https://github.com/sec-dojo-com/CVE-2026-21858

https://github.com/sastraadiwiguna-purpleeliteteaming/SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

https://github.com/exploitChains/poc-collection

https://github.com/samael0x4/CVE-2026

https://github.com/cropnet/ni8mare-scanner

https://github.com/JanhaviSoni7/CVE-Timeline-Generation

https://github.com/Ashwesker/Ashwesker-CVE-2026-21858

https://github.com/Chocapikk/CVE-2026-21858

https://github.com/eduardorossi84/CVE-2026-21858-POC

https://github.com/hlsitechio/shellockolm

https://github.com/hlsitechio/Shellockolm-AI-CLI-MCP-Scanner

https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858

https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg

Details

Source: Mitre, NVD

Published: 2026-01-08

Updated: 2026-01-16

Named Vulnerability: Ni8mare

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.78447

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability Being Monitored

Detections

Analytics