Ni8mare: The CVSS 10.0 n8n Flaw That Turns a Webhook Into a Full Server Takeover

Описание и применение

Обновление n8n до версии 1.121.0 или выше устраняет уязвимость CVE‑2026‑21858, позволяющую удалённому атакующему читать любые файлы через вебхук, что приводит к полной компрометации сервера.

Задача

An unauthenticated attacker can read any file on a vulnerable n8n instance via a crafted webhook request, leading to full server takeover.

Результат

Upgrading to n8n 1.121.0 or later eliminates the Ni8mare vulnerability, preventing unauthenticated file reads and full server takeover.

Рабочий процесс

• Check n8n version via Settings → About or docker exec n8n --version
• Back up workflows and database, and ensure N8N_ENCRYPTION_KEY is stored off‑server
• Pull the patched image with docker compose pull n8n
• Recreate the container with docker compose up -d
• Verify logs show successful startup and migrations
• Pin the image tag in docker-compose.yml to a fixed version ≥1.121.0
• If using npm, run npm install -g [email protected] and restart the process
• After patching, review exposure: check Shadowserver/Censys for your IP, inspect webhook logs for anomalous Content‑Type headers, rotate N8N_ENCRYPTION_KEY and all stored credentials, audit user sessions

Доказательства

Ni8mare (CVE-2026-21858) lets a remote, unauthenticated attacker send one specially crafted request to an n8n webhook and walk away with any file on the server — API keys, database contents, credentials, everything.

Источник

Ni8mare was reported to n8n's security team on November 9 and patched nine days later in n8n 1.121.0.

Источник

The bug: n8n's file-handling code reads from req.body.files without verifying the request actually went through the upload parser.

Источник