Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

N8n form-based workflow file-read flaw (CVE-2026-21858)

Vulnerability
First reported
Last updated
Happening score
H score 68
2 unique sources, 2 articles

Summary

Hide ▲

n8n disclosed CVE-2026-21858 (CVSS 10.0), a maximum-severity Content-Type confusion flaw in form-based workflows that can let an unauthenticated remote attacker read local files and potentially gain admin access. The issue can expose sensitive configuration data and secrets on susceptible instances, creating a path toward full compromise. n8n says the flaw was fixed in version 1.121.0 and affects all versions prior to and including 1.65.0.

Related Happenings

OpenClaw command-injection, path-traversal, and link-following flaws (multiple vulnerabilities)

Vulnerability
H score33 First: 10.07.2026 17:19 Last: 10.07.2026 17:19 Sources 1

About this happening: OpenClaw now has three patched high-severity vulnerabilities that can lead to credential theft, privilege escalation, and arbitrary code execution on the host....

Open Happening

N8n actively exploited remote code execution vulnerability (CVE-2025-68613)

Vulnerability
H score70 First: 11.03.2026 20:21 Last: 11.03.2026 20:21 Sources 1

About this happening: An actively exploited n8n remote code execution flaw, CVE-2025-68613, lets authenticated attackers run arbitrary code on vulnerable servers and can lead to full compro...

Latest development: 12.03.2026 07:18

CISA adds CVE-2025-68613, an n8n expression-injection flaw with CVSS 9.9 that can lead to remote code execution, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation; CISA says it is the first n8n vulnerability placed in KEV.

Open Happening

N8n sandbox escape flaws (multiple vulnerabilities)

Vulnerability
H score41 First: 04.02.2026 15:00 Last: 04.02.2026 15:00 Sources 1

About this happening: Two maximum-severity sandbox-escape flaws in n8n expose self-hosted and cloud instances to complete server takeover and credential theft. An authenticated us...

Open Happening

Quiz and Survey Master SQL injection mitigation (CVE-2025-67987)

Advisory/Mitigation
H score61 First: 03.02.2026 18:15 Last: 03.02.2026 18:15 Sources 1

About this happening: Patchstack published mitigation guidance for CVE-2025-67987, directing administrators to update Quiz and Survey Master to version 10.3.2 to close a SQL injection...

Open Happening

N8n eval injection sandbox bypass flaws (multiple vulnerabilities)

Vulnerability
H score39 First: 28.01.2026 14:43 Last: 28.01.2026 14:43 Sources 1

About this happening: Two n8n eval-injection flaws, CVE-2026-1470 and CVE-2026-0863, now expose susceptible instances to authenticated remote code execution and arbitrary Python code...

Open Happening

Timeline

  1. 07.01.2026 15:48 2 articles · 6mo ago

    Discovery of CVE-2026-21858 in n8n

    Technical Analysis Update

    Security researcher Dor Attias discovered and reported CVE-2026-21858 in n8n on November 9, 2025, identifying a Content-Type confusion flaw in form-based workflows that could let an attacker access files on the underlying server.

    Show sources
    Open in new tab
  2. 07.01.2026 15:48 1 articles · 6mo ago

    n8n patches CVE-2026-21858 in version 1.121.0

    Mitigation Patch Update

    n8n released version 1.121.0 on November 18, 2025 to address CVE-2026-21858, a flaw affecting all versions of n8n prior to and including 1.65.0 that could expose sensitive information and enable further compromise depending on deployment configuration and workflow usage.

    Show sources
    Open in new tab
  3. 07.01.2026 15:48 1 articles · 6mo ago

    Public disclosure of CVE-2026-21858 in n8n

    Initial Disclosure

    Cybersecurity researchers disclosed CVE-2026-21858 in n8n on January 7, 2026, describing a maximum-severity Content-Type confusion issue in form-based workflows that could allow an unauthenticated remote attacker to read local files, extract sensitive secrets, forge administrator access, and potentially execute arbitrary commands on the server.

    Show sources
    Open in new tab