n8n Form Webhook Unauthenticated File Access (Ni8mare)
- Product
- n8n n8n
- CVE
- CVE-2026-21858
- Disclosed
- 2026-01-07
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- n8n >= 1.65.0, < 1.121.0
- Fixed
- 1.121.0
Summary
Cyera found that public n8n form workflows could be tricked into reading arbitrary files from the server. By stealing the instance's secrets and database, an unauthenticated attacker could forge an admin session and then use n8n's own features to execute commands.
Root cause
Form/webhook handling trusted the request Content-Type when parsing uploads; sending a non-multipart body let the attacker control the internal 'files' object, including the local filepath n8n would read. Reading the config and SQLite database leaked the encryption key and user data needed to forge an admin auth cookie, after which workflow features give command execution.
Impact
Unauthenticated file read leading to full instance takeover and remote code execution.
Detection
Version check (1.65.0 - 1.120.x); look for form/webhook requests with application/json bodies containing 'files' objects referencing local paths.
Mitigation
Upgrade to 1.121.0+; until then restrict or disable public form and webhook endpoints.