erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: January 7, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 5 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Ni8mare. Anyone self-hosting n8n (Docker, npm or source) below 1.122.0, especially with public Form or webhook endpoints.
  • Do you run any of these? Hewlett Packard Enterprise (HPE) OneView, Microsoft Office. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-01-28.
  • PyPI: 2 critical advisories (wolfssl, terminal-controller). Check with pip-audit (or: pip show <package>).
  • npm: 1 critical advisory (n8n). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/openflagr/flagr). Check with govulncheck ./....
  • Maven: 1 critical advisory (io.undertow:undertow-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-21858, CVE-2025-68613

Ni8mare: n8n Unauthenticated Takeover, Plus a KEV RCE

If you self-host n8n and anything about it is reachable from the internet, upgrade today: one bug lets strangers in through public forms, and its companion RCE is on CISA's exploited list.

Must act: Anyone self-hosting n8n (Docker, npm or source) below 1.122.0, especially with public Form or webhook endpoints.

Can relax: Instances already on 1.122.0 or later that sit behind a VPN or SSO proxy with no public forms; n8n Cloud customers still need to confirm their version.

  1. Check the running version (Settings > About, or docker exec <container> n8n --version) and upgrade to 1.122.0 or later
  2. Until patched, block public access to /form and /webhook paths at the proxy or disable public Form workflows
  3. Require authentication on every Form node and put the editor UI behind SSO or VPN

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-37164Hewlett Packard Enterprise (HPE) OneView
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability		2026-01-28
CVE-2009-0556Microsoft Office
Microsoft Office PowerPoint Code Injection Vulnerability		2026-01-28

Critical advisories by ecosystem 5

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 2

Check: pip-audit (or: pip show <package>)

Go 1

Check: govulncheck ./...

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

npm 1

Check: npm audit (or: npm ls <package>)