A critical vulnerability (CVE-2026-21858, CVSS 10.0) in the n8n automation platform allows attackers to take over instances, affecting ~100,000 servers. Upgrade to version 1.121.0 or later to remediate this issue. n8n simplifies automation with webhooks and user-friendly interfaces. A “Content-Type Confusion” bug allows arbitrary file reads and a potential RCE by exploiting mismatched content types. Risk escalates as n8n connects multiple systems. Action: Update n8n, limit exposure, and require authentication for Forms.
Ni8mare – Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
