Ni8mare flaw in n8n automation platform enables full server takeover

Researchers disclosed a maximum-severity vulnerability in n8n, an open-source workflow automation platform, on Jan. 7, and the Canadian Centre for Cyber Security followed with alert AL26-001 on Jan. 12, covering it and two related flaws.

n8n is popular for connecting business systems and building AI agent workflows, which means a typical instance holds API keys and credentials for many other services. A compromise can therefore expose far more than the server itself. The Hacker News, citing Censys, reported 26,512 n8n hosts exposed to the internet.

The flaws

• CVE-2026-21858, rated 10.0 and nicknamed "Ni8mare" by Cyera Research Labs, lets an unauthenticated attacker read files on the server through certain form-based workflows. It affects versions 1.65.0 up to 1.121.0. The Hacker News reported that researcher Dor Attias found that n8n's form handler copies files without checking the request type, letting an attacker point it at any local file. From there, an attacker can pull the database and encryption key, forge an administrator session and create a workflow that runs system commands.
• CVE-2026-21877, rated 9.9, lets an authenticated user execute code through the n8n service. It is fixed in 1.121.3, and n8n says disabling the Git node reduces exposure.
• CVE-2025-68613, rated 9.9 by n8n, allows authenticated users to run code because workflow expressions are not isolated from the runtime. It is fixed in 1.120.4, 1.121.1 and 1.122.0. CISA added it to its Known Exploited Vulnerabilities catalog on March 11, 2026.

The Cyber Centre said public proofs of concept exist, including one that chains CVE-2026-21858 and CVE-2025-68613 to gain unauthenticated code execution. It also noted that the n8n 1.x branch was due to reach end of life in early March 2026.

What to do

• Upgrade self-hosted n8n to the latest supported release in the 1.x or 2.x line.
• Do not expose n8n directly to the internet, and require authentication on every form.
• Restrict or disable public webhook and form endpoints until patched, and limit workflow editing to trusted users.
• Rotate credentials stored in n8n if an instance was internet-facing before the update.