2026-07-28 · ~6 min read

Your n8n is probably fine. The setup page is the problem.

In January, n8n had a CVSS 10.0 remote code execution bug and everyone patched in a hurry. Good. That is not what this post is about, because it is not how most n8n instances actually get owned.

Most of them get owned through the front door. You install n8n, you expose it to the internet to test a webhook, you get busy, and the setup screen sits there waiting. Here is the thing about that screen: the first person to open it becomes the admin. Not you. Whoever gets there first. They create the owner account, and now they can read every credential you will ever store in that instance.

I know this is not theoretical because I run an exposed n8n as a honeypot, and the setup page is the first thing bots request. They are not checking for Ni8mare. They are checking whether anyone claimed the instance yet.

The 30 second check

Open an incognito window. Not a normal tab, incognito, so your own login does not hide the truth. Go to your n8n URL.

If you see a login form asking for email and password: fine, someone owns it, move along. If you see a friendly screen inviting you to set up an owner account: that is the problem, and the clock is running. Every hour it sits like that is an hour any bot on the internet can claim your instance.

From the outside, you can also check the API:

curl -s http://YOUR.SERVER.IP:5678/rest/settings | grep -o 'showSetupOnFirstLoad[^,]*'

If that returns true, the setup page is up. On n8n 1.x the marker is called isInstanceOwnerSetUp instead, and you want it to be true. (The marker changed in 2.x, which is why most scanners miss this check entirely. Mine did too, until I caught it against a live box.)

If it is unclaimed

Claim it. Right now. Open the page yourself and create the owner account before anyone else does. That is the entire fix for this one: whoever does it first wins.

Then do the boring things that matter:

• Put n8n behind your VPN or Tailscale, or at least behind a proxy with its own auth. It is an internal automation tool, it does not need to be a public website.
• If it must be public, HTTPS only. Webhooks still work fine behind a proper reverse proxy.
• Rotate the credentials stored in it if it sat unclaimed for a while. You have no way to know who visited before you did.

And yes, patch too

Quick version check while you are in there. Ni8mare (CVE-2026-21858) hits everything from 1.65.0 to just before 1.121.0, and there is a second actively exploited RCE (CVE-2025-68613) covering versions from 0.211.0 up to 1.120.3 plus 1.121.0. The safe line today is 1.122.0 or later. Check yours:

curl -s http://YOUR.SERVER.IP:5678/rest/settings | grep -o 'n8n@[0-9.]*'

But notice the order of this post. Patching is the thing everyone did in January. Claiming the front door is the thing most people still have not done. The bots know. The fix card with the short version is at /fixes/n8n-exposed, and the scanner checks for all of this, the setup page included, in about thirty seconds.