CRITICAL n8n: n8n CVE-2026-21858 (Ni8mare) — unauthenticated file read / RCE

Why it matters

Your n8n version is in the range affected by Ni8mare, a CVSS 10.0 bug: a stranger can abuse a form-based workflow to read any file on the server — including every API key and credential n8n stores — and in many deployments take the whole instance over. Upgrade today.

Fix it — 3 steps

Upgrade n8n to 1.121.0 or later (2.x is already patched): `npm update -g n8n` or pull the latest docker image and recreate the container.
While unpatched, block public access to webhook and form endpoints — or take the instance off the public IP entirely.
Rotate any credentials stored in n8n if the instance was publicly reachable while vulnerable.

Verify it’s fixed

docker exec <n8n-container> n8n --version  # must be >= 1.121.0

References

https://github.com/advisories/GHSA-v4pr-fm98-w9pg
https://nvd.nist.gov/vuln/detail/CVE-2026-21858

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack