n8n Ni8mare CVE-2026-21858: upgrade to 1.122.0+

What happened

n8n is a workflow automation platform, widely used to wire AI agents to business systems. On 7 January 2026, n8n published CVE-2026-21858, rated CVSS 10.0. Versions 1.65.0 to before 1.121.0 let an attacker read files on the server through “certain form-based workflows”. A vulnerable workflow could give access to an unauthenticated remote attacker (GitHub advisory; CVE record).

Cyera found it and reported it on 9 November 2025, and named it “Ni8mare”. The root cause is a content-type confusion. File uploads sent as multipart/form-data go through a parser that stores them in random temporary locations. Other content types, such as application/json, use a standard parser that does not check for a real upload, but n8n still processes the file fields. Because the attacker controls the file metadata, including the path, they can make n8n copy any local file. Cyera says the copied files can expose stored secrets and be used to forge session cookies and bypass login (BleepingComputer). The fix shipped in 1.121.0 on 18 November 2025 (Rapid7).

The chain. Once the attacker has admin access, a second bug runs code. CVE-2025-68613 is an expression-injection flaw: expressions that an authenticated user enters in a workflow can be evaluated without enough isolation, and run code with the n8n process’s privileges. It affects 0.211.0 up to 1.120.4, and 1.121.0 (CVE record). On 7 January, the same day as Cyera’s write-up, a public proof of concept chaining the two was published (Rapid7).

CISA added CVE-2025-68613 to its Known Exploited Vulnerabilities catalog on 11 March 2026, with a deadline of 25 March. CVE-2026-21858 itself is not in the catalog as of 30 October 2026 (CISA KEV).

Rapid7 lists two more n8n flaws from the same period that need an authenticated user: CVE-2026-21877 (CVSS 9.9, fixed in 1.121.3), which is most serious when chained after the file read, and CVE-2025-68668, a sandbox bypass in the Python Code node affecting 1.x before 2.0.0 (Rapid7).

Cyera counted more than 100,000 vulnerable n8n servers at the time (BleepingComputer).

Am I affected?

Check the running version:

bash

# npm install
n8n --version
npm ls -g n8n

# Docker (container name varies)
docker exec n8n n8n --version

Version	CVE-2026-21858 (file read)	CVE-2025-68613 (RCE)
Below 1.65.0	Not affected	Affected from 0.211.0
1.65.0 to 1.120.3	Affected	Affected
1.120.4	Affected	Fixed
1.121.0	Fixed	Affected
1.121.1 and later	Fixed	Fixed

Sources: CVE-2026-21858, CVE-2025-68613, GitHub advisory. CVE-2026-21877 also affects everything before 1.121.3.

The unauthenticated path needs a workflow with a form that is reachable by the attacker. Rapid7 describes the condition as a custom web form with file uploads that do not validate content type (Rapid7). List your active workflows that start from a form or webhook trigger, and check which of them are reachable from the internet. n8n Cloud customers should follow n8n’s own notices; Rapid7 says CVE-2026-21877 affects both self-hosted and cloud deployments.

What to do now

Upgrade self-hosted n8n to 1.122.0 or later, which n8n names as the fix for CVE-2025-68613 (GitHub advisory). It also includes the fixes for CVE-2026-21858 and CVE-2026-21877.
If you cannot upgrade yet, restrict or disable publicly accessible webhook and form endpoints. n8n says there is no official workaround beyond this (GitHub advisory).
Limit who can create and edit workflows to fully trusted users, and run n8n with restricted operating system privileges and network access. n8n lists these as short-term measures for CVE-2025-68613 that do not remove the risk (GitHub advisory).
If an affected instance had public forms or webhooks, check for compromise. Look for workflows, users or expressions you did not create, and for executions of form workflows with unexpected content types. The file read can expose secrets stored on the server (BleepingComputer), so rotate the API keys and OAuth tokens saved in n8n credentials, and n8n user passwords.

Why this matters

n8n holds the keys to everything its workflows touch: CRMs, mailboxes, cloud accounts and, increasingly, AI agents with tool access. A file read on an automation server is rarely “only” a file read, because the files it can reach include the secrets for those systems.

Related advisories