CVE-2026-21858

n8n versions 1.65.0 through below 1.121.0 contain an input-validation flaw (CWE-20) in the handling of certain form-based workflows, allowing an unauthenticated remote attacker to reach the underlying server through form endpoints. By triggering a vulnerable form workflow, the attacker can access files on the host and expose sensitive information stored there; the Cyera research team (which named the bug "Ni8mare") and the CVSS 10.0 score with high integrity impact indicate this yields unauthenticated remote code execution and potential full takeover. Any self-hosted n8n instance running an affected version that exposes form-based workflows over the network is at risk, with blast radius amplified by n8n's typical access to credentials, secrets, and connected internal systems. The issue is fixed in version 1.121.0; the flaw is not yet in CISA's KEV, but a public proof-of-concept is available and EPSS assigns a 78.4% probability of exploitation within 30 days, so defenders should treat exploitation as likely and imminent.

What to do: Upgrade n8n to version 1.121.0 or later immediately. If you cannot upgrade right away, check whether any workflows use form triggers and remove those form endpoints from untrusted network exposure — place them behind authentication, a reverse proxy, or an IP allowlist. Review instance logs for unexpected requests to form/webhook paths and unusual file access, given the high EPSS score and public proof-of-concept.