PT-2026-1662 · N8N · N8N
Dorattias
·
Published
2026-01-07
·
Updated
2026-06-22
·
CVE-2026-21858
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
n8n versions 1.65.0 through 1.121.0
Description
An issue in the input validation mechanism of the n8n workflow automation platform allows unauthenticated remote attackers to gain full control over instances, affecting approximately 100,000 servers globally. The flaw stems from a Content-Type mismatch bug in how the platform processes form-based webhook requests. Specifically, the middleware determines the parser based on the Content-Type header, but the Form Webhook Node fails to validate this header before processing files. By changing the Content-Type from
multipart/form-data to application/json and sending a crafted payload, an attacker can override the req.body.files object and manipulate the file path processed by the system.This enables arbitrary file reads, including the local SQLite database (
/home/node/.n8n/database.sqlite) and the configuration file containing the encryption secret. With these files, an attacker can forge an admin session cookie to authenticate without credentials and subsequently use the Execute Command node to perform remote code execution on the server. Real-world scanning campaigns have been observed using a specialized user agent n8n-scanner/1.0 to identify vulnerable endpoints via dictionary-based path enumeration.Recommendations
Update to version 1.121.0 or later.
Restrict or disable publicly accessible webhook and form endpoints as a temporary mitigation.
Avoid exposing the platform directly to the internet without a VPN or additional authentication.
Require authentication on all public forms.
Rotate all stored credentials and API keys if a prior compromise is suspected.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
N8N