CVE-2026-21858

Name of the Vulnerable Software and Affected Versions n8n versions 1.65.0 through 1.120.x

Description An unauthenticated remote code execution issue exists in the n8n workflow automation platform due to a Content-Type mismatch bug in how the system processes Form webhook requests. The middleware determines the parser based on the Content-Type header, but the Form Webhook Node fails to validate this header before processing files. An attacker can change the Content-Type from multipart/form-data to application/json and send a crafted payload to override the req.body.files object, including the file path. This allows arbitrary file reads from the system, including the local SQLite database and configuration files containing encryption secrets. By obtaining these files, an attacker can forge an admin session cookie to gain unauthorized access and use the Execute Command node to run arbitrary code on the server. Approximately 100,000 servers worldwide are potentially affected. Real-world activity has been observed involving a scanning campaign from French infrastructure using a custom user agent n8n-scanner/1.0 to identify vulnerable endpoints on Debian 12 systems.

Recommendations Update n8n to version 1.121.0 or later. Restrict or disable publicly accessible webhook and form endpoints as a temporary mitigation. Avoid exposing n8n directly to the internet without a VPN or additional authentication. Require authentication on all public forms. Rotate all stored credentials and API keys if a prior compromise is suspected.