Skip to content
Critical Ni8mare CVE-2026-21858 Flaw in n8n Allows Full Server Takeover

Critical Ni8mare CVE-2026-21858 Flaw in n8n Allows Full Server Takeover

First seen 18 Oct 2026, 01:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 02:09 UTC
  • •Ni8mare (CVE-2026-21858) allows full server takeover via a single HTTP request.
  • •Approximately 60,000 n8n instances are still vulnerable and exposed to attacks.
  • •Immediate patching is essential to mitigate the risk of exploitation.

A critical vulnerability, Ni8mare (CVE-2026-21858), has been discovered in older n8n installations, allowing remote, unauthenticated attackers to exploit a webhook and access any file on the server, including sensitive data like API keys and credentials. This flaw has a CVSS score of 10.0, indicating its severe nature. The Shadowserver Foundation reported nearly 60,000 internet-connected n8n instances are still running vulnerable versions. The vulnerability arises from n8n's improper handling of incoming webhook data, where attackers can manipulate the Content-Type header to bypass security checks. Cyera's write-up has reignited awareness of this issue, emphasizing the need for immediate action. The flaw has been publicly known since January 2026, with a proof-of-concept available since October 2023. Users are urged to patch their systems to prevent exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2023-10-12
First public PoC released
A proof-of-concept for the vulnerability was made public, demonstrating the exploit.
Dev.To
2026-01-07
CVE-2026-21858 published
The vulnerability was officially published with a CVSS score of 10.0, indicating critical severity.
Dev.To
Recent
Awareness raised by Cyera
Cyera's write-up on the vulnerability circulated, highlighting the number of exposed n8n instances.
Dev.To

More articles in this cluster (3)

Following this threat?

Track CVE-2026-21858 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which versions of n8n are affected?
Older n8n installations that have not been updated are vulnerable to CVE-2026-21858.
Is there a patch available?
Yes, users should apply the latest updates from n8n to mitigate this vulnerability.
How can I check if my n8n instance is vulnerable?
You can check the version of your n8n installation and compare it against the latest release notes from the official n8n website.