Quick Summary
A severe vulnerability known as ‘Ni8mare’ affects nearly 60,000 n8n instances, allowing remote attackers to gain control over these systems. This flaw, tracked as CVE-2026-21858, arises from improper input validation, enabling unauthorized access to sensitive data. The n8n automation platform, commonly used for AI development, is at risk, prompting urgent updates to version 1.121.0 or later to mitigate potential attacks.
The Securityish Brief
Nearly 60,000 instances of the n8n automation platform are vulnerable due to a maximum-severity flaw dubbed ‘Ni8mare,’ tracked as CVE-2026-21858. Discovered by Cyera researchers and reported to n8n in early November, this vulnerability allows remote, unauthenticated attackers to take control of locally deployed n8n instances by exploiting an improper input validation weakness. The flaw can expose sensitive information stored on the system and may enable further compromise depending on the deployment configuration.
As of the latest reports, Shadowserver identified over 105,000 unpatched n8n instances online, with approximately 59,558 still exposed. The majority of these vulnerable instances are located in the United States and Europe. The flaw specifically affects workflows that accept file submissions, which can lead to unauthorized access and manipulation of sensitive data.
Why This Matters for Your Security
This vulnerability poses significant risks to organizations using n8n for automation, especially since it often stores critical API keys, OAuth tokens, and other sensitive credentials. If exploited, attackers could forge session cookies, inject malicious files, or execute arbitrary commands, leading to severe data breaches. The n8n team has emphasized that there is no official workaround available, making it crucial for administrators to upgrade their instances promptly.
For those unable to upgrade immediately, it is recommended to restrict or disable publicly accessible webhook and form endpoints to mitigate potential attacks. Additionally, n8n provides a workflow template for scanning instances for vulnerable workflows, which can help administrators identify and address security risks proactively.
Organizations should prioritize updating their n8n instances to the latest version to safeguard against the Ni8mare vulnerability. Regular monitoring of configurations and access controls can further enhance security posture and reduce the risk of unauthorized access.
Key Takeaways
- Upgrade your n8n instances to version 1.121.0 or later to patch the Ni8mare vulnerability.
- Restrict or disable publicly accessible webhook and form endpoints if immediate upgrades are not possible.
- Use the provided workflow template to scan your n8n instances for potentially vulnerable workflows.
- Regularly monitor your n8n configurations and access controls to enhance security.
- Stay informed about future vulnerabilities and updates related to n8n to maintain a secure environment.
Key Terms & Concepts
- n8n: n8n is an open-source workflow automation platform that connects applications and services to automate tasks without coding.
- CVE-2026-21858: CVE-2026-21858 is the identifier for the Ni8mare vulnerability affecting n8n instances, allowing unauthorized access due to improper input validation.
- API keys: API keys are unique identifiers used to authenticate requests made to an API, often storing sensitive information.
- OAuth tokens: OAuth tokens are credentials used to authorize access to resources on behalf of a user without sharing their password.
- Shadowserver: Shadowserver is an internet security watchdog group that monitors and reports on exposed vulnerabilities and threats online.
Read the original article here: https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-impacts-nearly-60-000-n8n-instances/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
