n8n Unauthenticated Remote Code Execution

CVE-2026-21858 arises from a Content-Type confusion flaw in n8n’s webhook and form handling logic. Specifically, certain form-based workflows do not adequately validate or enforce multipart form content types, allowing attackers to override internal request parsing state. This allows unauthenticated attackers to:

- Read arbitrary files from the server filesystem
- Extract sensitive internal secrets (e.g., database files, auth keys)
- Forge valid authentication sessions
- Construct workflows that execute arbitrary operating system commands
- Fully compromise the host, leading to complete server takeover

The issue stems from improper input validation (CWE-20) and flawed logic in how webhook payloads are parsed and handled, enabling manipulation of internal variables that control file handling.

Censys telemetry reports an estimated tens of thousands (26,512) of potentially exposed and vulnerable n8n instances when queried across the public internet via service detection.

While no confirmed widespread exploitation campaigns have been documented at the time of disclosure, the unauthenticated nature and straightforward exploitability make this highly likely to be weaponized rapidly by scanning and exploitation tools.