CVE-2026-21858

What it actually does

The flaw is an improper input validation issue in n8n form-based workflows. When a vulnerable workflow accepts unauthenticated form input and uses that input in file-handling logic, an attacker can cause the n8n server to read files from the underlying host filesystem that should not be exposed. The immediate impact is arbitrary local file disclosure from the n8n runtime context; depending on how n8n is deployed, disclosed files may include workflow data, environment variables, API credentials, database files, SSH keys, service tokens, or cloud credentials. If those secrets are usable elsewhere, the vulnerability can become an initial access and privilege-escalation path rather than only an information disclosure issue.

Why it matters to the business

A remotely reachable n8n instance with vulnerable form workflows can leak sensitive operational data without authentication. Because the issue has a critical severity, high EPSS probability, weaponized exploit maturity, and reported exploitation activity associated with the Ni8mare threat actor, exposed systems should be treated as high-priority remediation targets even though the issue is not currently listed in CISA KEV. Successful exploitation can lead to credential theft, exposure of customer or business data handled by automations, compromise of connected SaaS and infrastructure accounts, disruption of automated business processes, and costly incident response or secret-rotation efforts.

How an attack unfolds

An attacker first discovers an internet-accessible n8n service and identifies form-based workflows that can be reached without authentication. They then submit crafted form data intended to influence how the workflow resolves or reads files on the server. If the workflow passes untrusted form input into vulnerable file-access behavior, the n8n process returns or otherwise exposes the contents of local files. The attacker typically starts with low-risk reconnaissance files to confirm exploitability, then attempts to retrieve configuration files, n8n runtime data, environment variables, workflow database content, private keys, and application secrets. With valid secrets, the attacker can pivot into connected systems such as databases, cloud accounts, source repositories, messaging platforms, or other APIs integrated with n8n. Reported weaponization and Ni8mare activity mean defenders should assume scanning and repeat exploitation attempts are plausible for any publicly exposed n8n form endpoint.

How to fix it

Upgrade n8n to a version or source revision that contains the fix. For source-based deployments of n8n-io/n8n, ensure the deployed code includes commit faae32934230ca3f0a7da1798e6737c3891ef250 or a later release containing that commit. Where the affected packaged components are supplied by Debian, apply the vendor-fixed packages listed for the platform: Debian 11 fixed in 5.10.113-1 and Debian 12/13 fixed in 5.17.3-1. Remove duplicate or stale package pins that could hold vulnerable versions in place. As immediate mitigation, disable or unpublish unauthenticated form-based workflows that perform file reads, file uploads, path construction, command execution, or access to local storage. Require authentication or network allowlisting for n8n administration and sensitive workflows, place n8n behind a reverse proxy or private access layer where possible, and avoid exposing form endpoints directly to the public internet unless required. Review workflows to ensure user-supplied form fields are never used directly as filesystem paths; enforce strict allowlists, fixed directories, canonical path checks, and least-privilege filesystem permissions. Rotate n8n credentials, API keys, database passwords, cloud tokens, and SSH keys if exploitation is suspected or if sensitive files may have been exposed.

How to confirm the fix worked

Confirm the deployed n8n version, container image, package version, or source commit is at or beyond the fixed build. For source deployments, verify the running artifact includes commit faae32934230ca3f0a7da1798e6737c3891ef250 or a later patched release. For Debian-packaged affected components, verify installed package versions meet or exceed 5.10.113-1 on Debian 11 and 5.17.3-1 on Debian 12 or 13. Enumerate published n8n form workflows and confirm no unauthenticated workflow accepts user-controlled values that are used in file paths or file-read operations. From an untrusted network path, verify that sensitive form workflows are not accessible without the intended authentication or access controls. If performing security testing, use a controlled benign canary file and a non-production workflow rather than attempting to read real secrets. Confirm reverse proxy, WAF, and application logs show blocked or rejected path traversal and local-file access attempts after mitigation.

Typical attack path

1. Scan the internet or known assets for exposed n8n instances and public form or webhook-style routes.
2. Identify unauthenticated form-based workflows that accept user-controlled fields.
3. Submit crafted form values that attempt to cause the workflow or n8n runtime to read arbitrary local filesystem paths.
4. Confirm file disclosure using commonly available local files or application configuration artifacts.
5. Retrieve higher-value files such as n8n configuration, workflow database files, environment variables, tokens, SSH keys, or cloud credentials.
6. Use stolen secrets to access connected systems, modify automations, exfiltrate data, or establish persistence.
7. Cover tracks by blending requests into normal form submissions or by using compromised credentials for follow-on activity.

How to detect it

Investigate reverse proxy, load balancer, WAF, n8n application, container runtime, process, filesystem access, and host authentication logs for evidence of unauthenticated access to form endpoints followed by attempts to reference local files or traversal sequences. Prioritize requests to n8n form routes containing encoded or decoded traversal strings, absolute Linux paths, n8n data paths, environment-file references, SSH key paths, or process environment files. Review n8n execution history for form-triggered workflows that unexpectedly returned file contents, produced file-read errors, accessed unusual paths, or executed with attacker-controlled path-like input. Inspect the n8n host or container for reads of sensitive files by the n8n process around suspicious request times, especially /etc/passwd, /etc/shadow, /proc/self/environ, n8n database files, credential stores, SSH keys, and cloud credential files. Look for follow-on signs of credential compromise: new or modified workflows, newly created credentials, unexpected outbound HTTP requests from n8n, unusual API usage against integrated services, new administrative logins, and access from unfamiliar IP addresses after suspicious form submissions. Because Ni8mare activity is reported, correlate suspicious n8n exploitation attempts with broader intrusion activity such as credential reuse, data staging, automation tampering, and persistence in systems connected through n8n.

• GET /form/
• POST /form/
• GET /webhook/
• POST /webhook/
• GET /webhook-test/
• POST /webhook-test/
• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %252e%252e%252f
• %2e%2e%5c
• ..%5c
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /etc/hostname
• /proc/self/environ
• /proc/1/environ
• /root/.ssh/id_rsa
• /home/node/.ssh/id_rsa
• /home/node/.n8n/config
• /home/node/.n8n/database.sqlite
• /home/node/.n8n/
• /root/.n8n/
• /var/lib/docker/volumes/
• /.env
• /app/.env
• /home/node/.aws/credentials
• /root/.aws/credentials
• /home/node/.kube/config
• /root/.kube/config
• ENOENT: no such file or directory
• EACCES: permission denied
• Ni8mare

What your security team should do

• Treat internet-exposed n8n form endpoints as urgent due to critical severity, high EPSS, weaponized exploitation, and reported Ni8mare activity.
• Inventory all n8n deployments, including containers, source builds, managed hosts, and Debian-packaged installations, and identify publicly reachable form or webhook endpoints.
• Patch to a fixed n8n build containing commit faae32934230ca3f0a7da1798e6737c3891ef250 or later; apply Debian fixed versions where applicable.
• Immediately disable, restrict, or add authentication to unauthenticated form workflows that interact with local files, credentials, uploads, or dynamic paths.
• Review n8n workflows for unsafe use of form input in file path, file read, command, HTTP request, or credential-handling nodes.
• Search historical logs for traversal strings, sensitive file path requests, abnormal form submissions, and unexpected file-read errors.
• Assume secrets stored on the n8n host may be compromised if suspicious activity is found; rotate n8n credentials, workflow credentials, database passwords, cloud tokens, API keys, and SSH keys.
• Harden n8n runtime permissions by running as a non-root user, limiting filesystem mounts, removing unnecessary host volume access, and segmenting access to downstream systems.
• Add WAF or reverse-proxy rules to block traversal encodings and requests for sensitive local filesystem paths on n8n form routes.
• Monitor for follow-on activity from credentials integrated with n8n, including unusual API calls, workflow edits, new credentials, outbound connections, and data exports.