Critical Ni8mare Vulnerability (CVE-2026-21858) Exposes n8n Servers to Attack
- Securityish
- Threats & Incidents
Quick Summary
A severe vulnerability known as Ni8mare (CVE-2026-21858) allows remote attackers to take control of n8n servers, affecting over 100,000 instances. Discovered by Cyera, this flaw has a perfect severity score of 10 out of 10 and can expose sensitive information. n8n, an open-source workflow automation platform, is widely used for integrating applications and automating tasks, making this vulnerability particularly concerning for organizations relying on it.
The Securityish Brief
The Ni8mare vulnerability, identified as CVE-2026-21858, poses a significant risk to n8n, a popular open-source workflow automation platform. Researchers from Cyera discovered this flaw on November 9, 2025, which allows unauthenticated remote attackers to access files on n8n servers. With over 100,000 vulnerable instances, the flaw has a maximum severity score of 10 out of 10, highlighting its critical nature.
The vulnerability arises from a content-type confusion in how n8n processes incoming data through webhooks. When a request is marked as multipart/form-data, n8n uses a secure upload parser. However, if an attacker sends a different content type, such as application/json, they can bypass this parser, gaining control over file metadata and potentially accessing sensitive information stored on the server.
n8n is commonly used to orchestrate AI calls and automate data processes, making it a central hub for storing sensitive data like API keys and database credentials. The flaw can lead to serious consequences, including the exposure of secrets and unauthorized command execution.
Currently, n8n developers have not provided an official workaround for the Ni8mare vulnerability. They recommend updating to version 1.121.0 or later to mitigate risks. Additionally, restricting or disabling publicly accessible webhook and form endpoints can help protect against potential exploitation.
Practical Implications for Users and Organizations
Organizations using n8n should take immediate action to assess their exposure to the Ni8mare vulnerability. With the potential for attackers to access sensitive files, it is crucial to implement security measures that limit access to webhook endpoints. Regularly updating software can help mitigate vulnerabilities and protect against emerging threats.
Furthermore, organizations should monitor their n8n instances for any unauthorized access attempts and review their security configurations to ensure they are not exposing sensitive information. Given the widespread use of n8n in automating workflows, understanding and addressing this vulnerability is essential for maintaining data security.
Key Takeaways
- Update your n8n instance to version 1.121.0 or later to mitigate the Ni8mare vulnerability.
- Restrict or disable publicly accessible webhook and form endpoints to limit exposure to attacks.
- Regularly monitor your n8n server for unauthorized access attempts or suspicious activity.
- Review and tighten security configurations to protect sensitive data stored in n8n.
- Educate your team about the risks associated with the Ni8mare vulnerability and best practices for secure automation.
Key Terms & Concepts
- Ni8mare: In this article, Ni8mare refers to a critical vulnerability in the n8n workflow automation platform that allows remote attackers to gain control of servers.
- CVE-2026-21858: CVE-2026-21858 is the identifier for the Ni8mare vulnerability, which has a severity score of 10 out of 10.
- n8n: n8n is an open-source workflow automation tool used to connect applications and automate tasks.
Read the original article here: https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-lets-hackers-hijack-n8n-servers/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
