Critical N8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

Why It Matters

n8n orchestrates dozens of API keys and cloud credentials, so a single unauthenticated takeover can expose an entire organization’s integration ecosystem. The flaw forces enterprises to reassess the security posture of low‑code automation platforms.

Key Takeaways

• CVE‑2026‑21858 scores 10.0, unauthenticated remote takeover
• Exploits content‑type confusion in webhook file handling
• Affects all n8n versions ≤ 1.65.0, fixed in 1.121.0
• Attack reads database, steals secrets, executes arbitrary commands
• Upgrade immediately and limit public webhook exposure

Pulse Analysis

n8n has become a cornerstone for businesses seeking to stitch together SaaS applications without writing code, consolidating API keys, OAuth tokens, and database credentials in a single workflow engine. The platform’s rapid adoption has turned it into a high‑value target; a CVSS 10.0 rating signals that a successful exploit can compromise the entire attack surface of an organization. The recent string of critical vulnerabilities—four in two weeks—underscores the pressure on open‑source automation tools to maintain rigorous security hygiene while evolving features at breakneck speed.

The technical root of CVE‑2026‑21858 lies in a Content‑Type validation oversight within n8n’s webhook parser. By sending a crafted request with a non‑multipart header, an attacker can overwrite the global `req.body.files` object, forcing the server to treat any local file as an uploaded payload. This primitive enables arbitrary‑read of sensitive files such as the SQLite database and encryption keys, which can be leveraged to forge admin cookies and launch arbitrary command nodes. The resulting blast radius is massive: compromised instances expose not only internal data but also the credentials that grant access to downstream cloud services, effectively turning n8n into a single point of failure.

Mitigation begins with immediate upgrade to version 1.121.0 or later, which introduces proper content‑type checks and hardens file handling. Organizations should also enforce network segmentation, restricting public exposure of webhook endpoints and requiring authentication for all form nodes. In the broader context, the incident highlights the need for secure design patterns in low‑code platforms, especially around input validation and privilege separation. Enterprises deploying automation workflows must treat these tools with the same rigor as traditional codebases, incorporating regular vulnerability scanning and a zero‑trust approach to external integrations.