n8n CVE-2026-21858 Ni8mare: unauthenticated file access explained

CVE-2026-21858, nicknamed Ni8mare, is a critical n8n vulnerability rated CVSS 10.0. Releases from 1.65.0 up to but excluding 1.121.0 are affected; version 1.121.0 fixes the flaw, while the 2.x line was not affected. n8n Cloud was upgraded by its operator. Under a specific public-form configuration, an unauthenticated user could read local files from the server.

The conditions matter. The vulnerable case requires an active workflow with a Form Submission trigger and a Form Ending node that returns a binary file. Not every n8n instance or webhook was automatically exploitable. Organisations often have many workflows owned by different teams, however, so lack of awareness is not evidence that such a form does not exist.

What the vendor confirms

The official n8n advisory describes improper request handling that can provide file access and, depending on the deployment and workflows, further compromise. CVE-2026-21858 should not be presented as unconditional RCE in every installation. Local-file read is still a powerful primitive because an automation server commonly reaches configuration, databases, tokens, keys and integration secrets.

Reading an environment file, n8n configuration, SQLite database or credential-encryption key may let an intruder advance from disclosure to credential compromise. Impact depends on storage, process permissions, database design and use of an external vault. A sound report separates the confirmed read primitive from conditional post-exploitation paths.

Why automation has a large blast radius

n8n links systems that do not otherwise trust each other directly: CRM, email, cloud, repositories, chat, databases and administration tools. One workflow can hold credentials for several tenants. The application process also sees workflow definitions, execution history and data moving between nodes.

A public form looks like a low-risk business feature, but it fronts an engine with privileged integrations. Anonymous input meets a highly trusted backend. Segmentation and least-privilege credentials decide whether one file disclosure becomes a cross-system incident.

Establish exposure without exploitation

Record the running version, installation method and operating model: npm, Docker, Helm, appliance or hosted service. Verify the running image or package, not only a tag in IaC. A mutable tag can point to a new registry image while an old digest is still executing.

Inventory active workflows and locate Form Submission → Form Ending combinations returning binary data. Record public URL, upstream authentication, owner, last change and filesystem reach of the process. Reviewing exported workflow definitions is safer than sending traversal payloads to production.

The vendor gives no complete workaround when immediate upgrade is impossible. Temporarily disable or restrict public forms and webhooks — especially the affected combination — at both application and reverse-proxy layers. Keep this only until patch deployment.

Upgrade and validate

The first fixed 1.x release is 1.121.0. After upgrading:

1. verify version and digest on every main, worker and standby instance;
2. restart processes so the new code is actually active;
3. exercise a synthetic form returning only a controlled test file;
4. confirm path-like input returns neither local content nor detailed errors;
5. regression-test legitimate workflows, queues, credential storage and callbacks;
6. remove vulnerable images from automatic rollback paths.

Updating the editor while old queue workers continue running is insufficient. Queue mode can otherwise serve requests through mixed application versions.

Investigation and secret rotation

Review reverse-proxy and n8n logs for unusual parameters, encoded path separators, repeated 4xx/5xx responses, response sizes inconsistent with the form and automated scanning. Build a timeline for every public endpoint. Inspect workflow execution history, new or changed definitions, accounts, API keys and administrator logins.

If credible file access occurred, determine everything the application user could read. Rotation commonly prioritises N8N_ENCRYPTION_KEY, database access, cloud and repository credentials, email tokens, webhook signing secrets and OAuth grants. Rotate at the source system, not merely inside n8n.

Where credential-store compromise is plausible, export only reviewed workflows, build a clean environment and bind fresh secrets. Restoring the whole old database can restore exposed keys, unauthorised workflows or vulnerable state.

Harden n8n after the incident

• run as non-root with a read-only root filesystem;
• mount only required volumes, never a Docker socket or broad host path;
• use an external secret manager and narrowly scoped credentials;
• separate public webhooks from administration;
• apply egress allowlists to workers;
• version and review workflows like code;
• log publication and modification of public endpoints;
• test recovery from a clean image.

Combine these controls with API security, secrets management and software supply-chain security. Where public automation reaches critical systems, BreachRoad can review the trust boundaries.

---

Primary sources: n8n Security Advisory, GitHub Security Advisory GHSA-v4pr-fm98-w9pg.