Vulnerabilitycritical

Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

The Hacker Newsby @TheHackersNewsJan 8, 2026 · 09:26 UTC (Jan 8, 2026)4 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-21858 CVE-2025-68613 CVE-2025-68668 CVE-2026-21877

Tags: cve-2026-21858 cve-2025-68613 cve-2025-68668 cve-2026-21877 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-68613	Authenticated RCE in n8n Workflow Automation Expression Evaluation	8.8	99%	KEVPoC ×2	Dec 19, 2025 KEV Mar 11, 2026
CVE-2025-68668	n8n is an open source workflow automation platform	9.9	13%		Dec 26, 2025
CVE-2026-21858 +1 related CVE CVE-2026-21877	Unauthenticated RCE in n8n Workflow Automation (Ni8mare)	10.0 group max	78%	PoC ×2	Jan 8, 2026

From the original article

4 min read at thehackernews.com

Cybersecurity researchers have disclosed details of yet another maximum-severity security flaw in n8n , a popular workflow automation platform, that allows an unauthenticated remote attacker to gain complete control over susceptible instances. The vulnerability, tracked as CVE-2026-21858 (CVSS score: 10. 0), has been codenamed Ni8mare by Cyera Research Labs.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.