n8n: unauthenticated attackers can read server files through public Form workflows, leading to instance takeover (CVE-2026-21858)
Severity: critical · Patch status: patched · Since 2026-01-07 · CVE-2026-21858
n8n's Form webhook processed uploaded-file data without checking that the request was really multipart/form-data, so an attacker could send a normal body containing a forged file object and make n8n copy any local file path into the workflow. Any workflow with a publicly reachable Form trigger exposes this to someone with no account. Cyera, which reported it to n8n on 2025-11-09 and named it "Ni8mare", showed the file read escalating to full takeover on Docker and source installs: read the n8n database for the admin's user ID and password hash and the config file for the encryption key, forge an admin session cookie, then add an Execute Command node to run commands on the host. Versions 1.65.0 up to 1.121.0 are affected; the fix is 1.121.0, and the advisory was published on 2026-01-07. It is not in CISA's Known Exploited Vulnerabilities catalog, and Cyera did not release exploit code. n8n gives no official workaround beyond restricting or disabling public webhook and form endpoints until you upgrade.
What to do
- Upgrade n8n to 1.121.0 or later (npm package n8n; 1.65.0 and later are affected). Related expression-sandbox fixes have shipped since (CVE-2026-25049 is fixed in 1.123.17 and 2.5.2), so go to a current release.
- Until patched, disable or restrict every publicly reachable Form-trigger and webhook endpoint, as the vendor advises; this bug needs no login, so a reachable form is enough.
- If n8n is internet-facing only so that it can receive webhooks, receive them through a relay that forwards only the specific Webhook-trigger paths you name (for example Webhook Relay, https://webhookrelay.com/blog/n8n-security/), so form pages, the editor and the login page are not public. This only helps if you do not forward form paths; it does not fix the bug.
- If a Form workflow was public while unpatched, treat the instance as compromised: rotate the n8n encryption key and every credential stored in n8n, reset admin passwords, and review recently created or changed workflows for Execute Command nodes.
Fixed versions
Sources
All live incidents on Threat Watch
