n8n Unauthenticated RCE "Ni8mare" (CVE-2026-21858)
Date: 2026-01
Affected: n8n Unauthenticated RCE "Ni8mare" (CVE-2026-21858)
Attack vector: data-exfiltration
Category: real-world
Severity: Critical
CVE: CVE-2026-21858
CWE: CWE-20
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVSS 10.0. Content-type confusion in webhook request handling allows unauthenticated attackers to forge uploaded files, read arbitrary local files, forge admin sessions, and execute commands on the host. ~100,000 n8n servers globally affected. If an LLM-powered chatbot node is present, attackers can exfiltrate file contents by chatting with the bot. Fixed in v1.121.0.


Mitigations:

Architectural layers (MAESTRO):