Ni8mare: n8n Unauthenticated Takeover, Plus a KEV RCE

What to do

Check the running version (Settings > About, or docker exec <container> n8n --version) and upgrade to 1.122.0 or later
Until patched, block public access to /form and /webhook paths at the proxy or disable public Form workflows
Require authentication on every Form node and put the editor UI behind SSO or VPN
Limit workflow create/edit rights to fully trusted users
If the instance was exposed while vulnerable, rotate the N8N_ENCRYPTION_KEY, all stored credentials and user passwords

How to check if you are affected or compromised

Review proxy logs for POSTs to Form/webhook URLs with Content-Type application/json carrying a files object or filesystem paths
Look for new admin sessions, new users, or workflows containing Execute Command or Code nodes you did not create
Check workflow execution history for unexpected reads of /home/node/.n8n/ (database.sqlite, config)

What happened#

On January 7, 2026, n8n published GHSA-v4pr-fm98-w9pg (CVE-2026-21858, CVSS 10.0). n8n is the self-hostable workflow tool that many teams now use to glue LLM agents to their internal systems. The flaw lets an unauthenticated attacker read files on the server through certain form-based workflows. Dor Attias of Cyera reported it and named it "Ni8mare."

The Cyera write-up describes a Content-Type confusion bug. The Form webhook calls file-handling code that assumes req.body.files is only filled by the multipart parser. If an attacker sends application/json instead, they control that object and can point filepath at any local file, which n8n copies into workflow data.

Cyera then chains that file read into full takeover in four steps:

Read the n8n SQLite database to get the admin's user record.
Read the config file to get the encryption key.
Forge an admin session cookie.
Create a workflow with an Execute Command node to run OS commands.

Cyera estimated about 100,000 affected locally deployed servers.

A second flaw matters even more for today's verdict. CVE-2025-68613, published December 19, 2025, is an expression-injection RCE that any user able to edit workflows can trigger. CISA added it to the Known Exploited Vulnerabilities catalog on March 11, 2026, with a federal due date of March 25. Rapid7 lists public proof-of-concept code for both CVEs and notes that the authenticated bugs, including CVE-2025-68613, can be chained after Ni8mare.

Who is affected#

CVE-2026-21858: n8n 1.65.0 up to (not including) 1.121.0. Fixed in 1.121.0, which shipped November 18, 2025, weeks before the advisory.
CVE-2025-68613: versions from 0.211.0 up to the fixed releases 1.120.4, 1.121.1 and 1.122.0, per the CVE record. Its advisory recommends 1.122.0 or later.

Rapid7 also tracks CVE-2025-68668, CVE-2025-68697 and CVE-2026-21877. All three require authentication, and some are fixed only in later releases, so do not stop at the minimum version.

Do you really need to act?#

For self-hosted, internet-reachable n8n: yes, today.

Ni8mare does have preconditions:

A workflow with a Form node reachable without authentication.
Some way for the attacker to read the copied file back out of a later node.
For the full chain, a default local install where the database and config sit at predictable paths.

Public forms are a normal n8n pattern, though. Once an attacker is admin, CVE-2025-68613, which is confirmed exploited, gives code execution, and the n8n host usually holds credentials for every connected SaaS, database and LLM provider.

If your instance sits behind a VPN or SSO and has no public forms, the unauthenticated route is closed. Still upgrade, because any compromised or low-trust editor account can use the KEV-listed RCE.

What to do now#

Check the version under Settings > About, or run docker exec <container> n8n --version. Upgrade to 1.122.0 or later; the newest 1.x or 2.x release is better.
Until then, the advisory says there are no official workarounds. Block or disable public /form and /webhook endpoints at your reverse proxy.
Require authentication on every Form node and put the editor behind SSO or a VPN.
Limit who can create or edit workflows.
If the instance was exposed while vulnerable, rotate the encryption key, every stored credential and all user passwords.

How to tell if you were hit#

Search reverse-proxy logs for POSTs to form or webhook URLs sent as application/json that carry a files object or filesystem paths, such as /home/node/.n8n/. In n8n itself, look for unfamiliar admin logins, new users, or workflows with Execute Command or Code nodes you did not create. Then review outbound activity from the credentials n8n stores.

Timeline#

Nov 9, 2025: Ni8mare reported to n8n.
Nov 18, 2025: n8n 1.121.0 released with the fix.
Dec 19, 2025: CVE-2025-68613 expression-injection RCE published.
Jan 7, 2026: GHSA-v4pr-fm98-w9pg and Cyera's Ni8mare write-up published.
Mar 11, 2026: CISA adds CVE-2025-68613 to KEV.

Vulnerability records

CVE-2026-21858 · n8n is an open source workflow automation platform.
CVE-2025-68613 · KEV 2026-03-11 · n8n is an open source workflow automation platform.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.