CVE-2026-21858
Published: 08 January 2026
Summary
CVE-2026-21858 is a critical-severity Improper Input Validation (CWE-20) vulnerability in N8N N8N. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching of the n8n vulnerability fixed in version 1.121.0 to eliminate unauthorized file access via form-based workflows.
Directly addresses the improper input validation (CWE-20) root cause by requiring validation of workflow inputs to block exploitation leading to server file access.
Enforces access control policies to restrict unauthenticated attackers from accessing sensitive files on the underlying server through vulnerable workflows.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation of a public-facing web application (n8n) to access arbitrary files on the server, directly mapping to T1190 (Exploit Public-Facing Application) for initial access and T1083/T1005 (File and Directory Discovery/Data from Local System) for collection.
NVD Description
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated…
more
remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
Deeper analysisAI
CVE-2026-21858 is a critical vulnerability in n8n, an open source workflow automation platform. It affects versions starting from 1.65.0 up to but not including 1.121.0, where certain form-based workflows enable an attacker to access files on the underlying server. The issue stems from improper input validation (CWE-20) and carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with no availability disruption.
An unauthenticated remote attacker can exploit the vulnerability by executing a vulnerable workflow, gaining unauthorized access to sensitive files on the server. This exposure can reveal confidential data and potentially lead to further system compromise, depending on the deployment configuration and specific workflow usage.
The vulnerability is addressed in n8n version 1.121.0. Official mitigation guidance is available in the GitHub security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg, with additional details provided by Cyera Research Labs at https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858. Security practitioners should prioritize upgrading affected instances and reviewing exposed workflows.
Details
- CWE(s)