Ni8mare: CRITICAL n8n Vulnerability (CVSS 10.0)

https://medium.com/media/73eef08c72c93a388c9a5fc68e07465d/href### TL;DR Ni8mare (CVE-2026–21858), a critical security vulnerability, was recently discovered in the popular automation tool n8n. Disclosed on January 7, 2026, it carries the highest possible CVSS severity score of 10.0.

It is classified as an unauthenticated remote code execution (RCE) vulnerability, meaning an attacker can take complete control of a server running n8n without needing login credentials.

Below is a detailed explanation of what this vulnerability entails and how it works:

1. The Core Issue: Content-Type Confusion

The fundamental flaw lies in how n8n processes incoming HTTP requests in Webhook nodes and forms.

The application assumes file uploads (the req.body.files object) are processed only when the request passes through a secure file upload parser, specifically multipart/form-data.

However, an attacker can send a request with a different content type (e.g., JSON) and manually inject a files object into the body.

The application fails to recognize this object as fake and processes it as if it were a legitimately uploaded file.

2. The Attack Chain

The attack proceeds in several steps, leading to full system takeover.

Arbitrary File Read: Since the attacker controls the files object, they can manipulate the file path. Instead of pointing to a temporarily uploaded file, the attacker points to any file on the server.

The goal is for the attacker to “read” sensitive files, typically the n8n configuration file or the SQLite database.

Data Exfiltration (Stealing Secrets): The attacker extracts critical data from these files, specifically the encryption secret and user information.

Authentication Bypass: Using the stolen encryption secret, the attacker forges a valid administrator session cookie (n8n-auth). The server is tricked into believing that the attacker is a logged-in administrator.

Remote Code Execution (RCE): After logging in as an administrator, the attacker creates a new automation workflow. They then insert an “Execute Command” node, which enables them to run arbitrary commands on the server’s operating system. These commands could include installing malware, mining cryptocurrency, or deleting data.

3. Affected Versions and Fix

Affected Versions: All n8n versions prior to 1.121.0.

The fix: Update immediately to version 1.121.0 or later, which includes a patch for input validation.

**Summary: **Ni8mare is dangerous because it combines a relatively simple logic error (missing validation) with a catastrophic impact. Since n8n often has access to API keys and other internal company systems to facilitate automation, an attacker gains access not just to the n8n server but also to the entire connected infrastructure.